96,787 results · Clear filters · Feed
-
High 7.1
An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versio…
-
High 8.6
Improper neutralization of special elements used in an OS command in Lenovo XClarity Integrator for Microsoft Windows A…
-
High 8.7
NULL-pointer dereference (DoS) in nginx-http-flv-module
nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then r->headers_in.host was NULL, nginx-http-flv-…
-
High 7.1
ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview
ideon is a self-hosted visual workspace. Prior to version 0.9.6, the SSRF protection in safeFetch is bypassed by IPv6 transition addresses that embed private IPv4 addresses. The isPrivateIP function in src/app/lib/ssrf.ts checks only a narrow set of IPv6 rang…
-
High 8.7
ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints
ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can pe…
-
High 8.5
Server-side request forgery in the server registration and update API in mcp-gateway-registry
Server-side request forgery (SSRF) in the server registration and update API in Amazon mcp-gateway-registry before 1.35.0 might allow an authenticated remote user to send requests from the gateway to internal network services and cloud instance metadata endpo…
-
High 8.8
Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator
Missing authorization in the external management API in Amazon mcp-gateway-registry 1.0.9 through 1.24.7 might allow an authenticated remote user to assign the registry administrator scope to their own identity group and obtain administrative control of every…
-
High 8.1
Pre-account hijacking in the authentication flow in Lagarto Chivato 0.4.1 and earlier on Web allows remote unauthentica…
-
High 7.3
Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it ca…
-
High 7.6
AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload f…
-
High 7.5
Webmin through 2.670 Users File Injection via acl/cert_issue.cgi
Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated Webmin users to inject lines by supplying unvalidated certificate DN fields containing newlines. Attackers can end a DN field with a backslash a…
-
High 7.2
Webmin through 2.670 Privilege Escalation via acl/save_group.cgi
Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated administrators to grant unauthorized modules by submitting arbitrary module lists in the mod parameter. Attackers with Webmin Users module access ca…
-
High 7.5
Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()
Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server files by supplying root-relative references in HTML passed to setHtml(). Attackers can embed iframe, img, link or script elements referencing p…
-
High 7.4
Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password
Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject empty passwords, causing LDAP binds to be performed as unauthenticated binds when LDAP authentication is enabled. Unauthenticated attackers…
-
High 8.2
@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values
@tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values into MDX expressions without escaping them. Authenticated content editors can save crafted values that break out of list field or highlightC…
-
High 7.8
Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in…
-
High 7.5
Cockpit: cockpit: denial of service via unbounded fragmented websocket messages
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a…
-
High 7.5
A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated attacke…
-
High 7.1
Fider: Server-Side Request Forgery (SSRF) via Webhook URL
Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetc…
-
High 8.7
Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
High 7.5
A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext, w…
-
High 7.3
Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions
A flaw was found in pappl-retrofit. The application fails to properly sanitize user-supplied filenames when handling the upload and deletion of PostScript Printer Description (PPD) files. A remote, unauthenticated attacker can exploit this directory traversal…
-
High 8.7
Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in …
-
High 8.8
Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (…
-
High 7.4
Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability…
-
High 8.1
A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2 renegotiat…
-
High 8.7
sync-rpc runs asynchronous commands synchronously by putting them in a separate proces. Prior to version 1.3.7, if an a…
-
High 7.6
Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements…
-
High 7.6
Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements…
-
High 7.5
A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connection…
-
High 7.5
geojson-vt is a JavaScript library for slicing GeoJSON data into vector tiles on the fly, primarily designed to enable …
-
High 7.5
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …
-
High 8.7
Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
High 8.1
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…
-
High 8.2
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…
-
High 8.7
Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
High 8.7
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers…
-
High 7.2
Probo: Vertical privilege escalation
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, an organization ADMIN can mint an OWNER membership via createUser, bypassing the owner-only set-owner authorization ga…
-
High 7.5
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive au…
-
High 8.9
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulner…