96,758 results · Clear filters · Feed
-
High 7.2
A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiMa…
-
High 7.2
A use of externally-controlled format string vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer…
-
High 8.0
A use of hard-coded credentials vulnerability in Fortinet FortiManager 8.0.0 through 8.0.1, FortiManager 7.6.0 through …
-
High 8.1
A use of externally-controlled format string vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1 may allow a remote…
-
High 7.5
A memory allocation with excessive size value vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 …
-
High 7.5
A uncontrolled resource consumption vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.…
-
High 8.7
A xml injection (aka blind xpath injection) vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 th…
-
High 8.2
A improper authentication vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, Forti…
-
High 7.5
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
High 7.5
A incorrect implementation of authentication algorithm vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMa…
-
High 7.6
A authorization bypass through user-controlled key vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7…
-
High 7.5
A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.…
-
High 7.5
A out-of-bounds write vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail…
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.5
A integer overflow or wraparound vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6…
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 8.8
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.2
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet …
-
High 7.1
An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versio…
-
High 8.6
Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows A…
-
High 8.7
NULL-pointer dereference (DoS) in nginx-http-flv-module
nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-…
-
High 7.1
ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview
ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 rang…
-
High 8.7
ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints
ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can pe…
-
High 8.5
Server-side request forgery in the server registration and update API in mcp-gateway-registry
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpo…
-
High 8.8
Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every…
-
High 8.1
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthentica…
-
High 7.3
Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…
-
High 7.6
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload f…
-
High 7.5
Webmin through 2.670 Users File Injection via acl/cert_issue.cgi
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash a…
-
High 7.2
Webmin through 2.670 Privilege Escalation via acl/save_group.cgi
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access ca…
-
High 7.5
Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing p…
-
High 7.4
Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers…
-
High 8.2
@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightC…
-
High 7.8
Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…
-
High 7.5
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
High 7.1
Fider: Server-Side Request Forgery (SSRF) via Webhook URL
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetc…
-
High 8.7
Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.3
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal…