405,240 results · Feed
-
High 8.2
A flaw exists in the server-side SSPI Kerberos authentication handler on Windows Enterprise builds of MongoDB. When pro…
-
Medium 6.8
Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and Lin…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a…
-
High 7.1
A use-after-free issue exists in MongoDB’s SBE (Slot-Based Execution) implementation of a window function accumulator u…
-
High 8.3
Winter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate
Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, the ImportExportController behavior applies userHasAccess() only to the import() and export() page actions, while Backend\Classes\Controller::execAjaxHandlers() dis…
-
High 7.0
Docker Engine overlay-network encryption rules are not restored after a firewalld reload
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload or start signals over D-Bus. T…
-
High 7.7
Cluster-API proxy overwrites forwarded client identity with its own
SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when buil…
-
Medium 6.5
Worklenz < 3.3.0 SQL Injection via Reporting Members Endpoint
Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows authenticated attackers to read arbitrary database contents by injecting SQL through the projects and status parameters. Attackers can send crafted va…
-
High 7.5
Everest Forms <= 3.6.3 - Unauthenticated Arbitrary File Read via 'Signature' Field Meta Key Branch of attach_entry_files
The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3 via the attach_entry_files() function. This is due to the function attaching any entry field value whose meta key matches /signature_/ to t…
-
High 7.7
Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the …
-
Medium 4.4
Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information disclosur…
-
Unscored —
In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size unde…
-
Medium 6.7
In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure softwa…
-
Unscored —
In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap d…
-
Unscored —
In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead…
-
Unscored —
In knee_function_info of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This coul…
-
Unscored —
In StNfc_hal_write of hal_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due …
-
Unscored —
In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared …
-
Unscored —
In sub_layer_hrd_parameters of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. Thi…
-
Unscored —
In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could le…
-
Unscored —
In cpb_cnt of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to lo…
-
Unscored —
In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of servic…
-
High 7.5
In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undr…
-
Unscored —
In s_inter_rps_pred of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could …
-
Unscored —
In check_constraint_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass ro…
-
Unscored —
In s_copy_host_apb_param of multiple files, there is a possible way to trigger an out of bounds read in the video decod…
-
Unscored —
In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer…
-
Unscored —
In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a log…
-
Unscored —
In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decod…
-
Medium 5.3
postal-mime < 4.2.1 Algorithmic Complexity DoS via processLine
postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email mess…
-
High 7.5
In CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process…
-
Unscored —
In getCodecQp of GC2AV1Enc.cpp, there is a possible way to trigger an out of bounds read during quantization table look…
-
Unscored —
In smfc_v4l2_s_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent …
-
Unscored —
In prev_run_vcore of hwcodec_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This coul…
-
Unscored —
In multiple functions of oem_svc_setup.c, there is a possible way to dump secure cache lines into non-secure memory on …
-
High 7.5
In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to …
-
Unscored —
In buffering_period of avc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could l…
-
High 7.5
In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap du…
-
Low 3.3
Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the g…
-
Unscored —
In fence_manager_extract_iif of fence_manager.c, there is a possible way to corrupt kernel memory via fence identifier …