405,382 results · Feed
-
High 8.3
Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised th…
-
High 8.8
Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arb…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside…
-
Medium 4.7
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outsid…
-
High 7.0
In Kura versions <= 5.6.2, the "Command" file-upload handler at `POST /admin/denali/file/command` extracts a client-sup…
-
High 7.4
In Kura versions <= 5.6.2, `CommandCloudApp.execute()` extracts a caller-supplied ZIP archive into a caller-supplied di…
-
High 8.7
In Eclipse Kura versions 5.4.0 through 5.6.2, the Service Listing V1 REST API read the JSON body of every request into …
-
High 8.6
In Eclipse Kura versions 5.1.0 through 5.6.2, the Configuration REST API v2 (org.eclipse.kura.rest.configuration.provid…
-
Medium 5.1
Gwenhywfar 5.14.2 contains a heap use-after-free vulnerability in GWEN_TLV_Buffer_To_DB() in src/parser/tlv.c, which fr…
-
High 7.8
apitrace 2.0 through 14.0 Heap Buffer Overflow via SnappyFile::flushReadCache()
apitrace 2.0 through 14.0 contains a heap-based buffer overflow in SnappyFile::flushReadCache() that allows attackers to write past m_compressedCache via an oversized compressed chunk length. Attackers can supply a crafted .trace file whose 4-byte chunk lengt…
-
Medium 5.1
Gwenhywfar 4.99.8beta before 5.14.2 contains a stack-based buffer overflow in GWEN_TLV_Buffer_To_DB() in src/parser/tlv…
-
Low 2.3
compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation witho…
-
High 8.8
In Eclipse Kura version 5.0.0 to 5.6.2, the Web Console allocates a new HTTP session for every request to its built-in …
-
Low 2.3
compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place …
-
Low 2.3
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed wit…
-
Low 2.3
compose-lint: Text in a pull request can issue CI workflow commands through compose-lint 0.31.0's JSON and SARIF output on stdout
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not sanitize the ##[ workflow-command opener inside strings written by --format json or --format sarif to stdo…
-
High 8.7
Aggregation queries can bypass authentication restrictions in @neo4j/graphql
Missing Authentication for Critical Function in aggregation queries in Neo4j @neo4j/graphql 5.0.0 before 5.12.17 and 7.0.0 before 7.6.8 allows remote attackers to read protected data via GraphQL aggregation queries. Field-level @authentication is not enforced…
-
Medium 5.3
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint escapes GitHub Actions workflow-command openers only after ASCII spaces and tabs, while the runner strips all leadi…
-
High 8.5
WatchGuard Endpoint Protection Local Privilege Escalation in Console-Service Communication Allows SYSTEM Code Execution
A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting…
-
High 7.0
VNote 3.11.0 before 4.12.0 OS Command Injection via Tasks Magic Variables
VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a…
-
Medium 5.0
Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules…
-
Critical 9.4
GroupOffice Vulnerable to RCE in TemplateParser eval() via Contact/labels
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template string (tpl parameter) that is pa…
-
High 8.7
Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108,…
-
Medium 5.3
Prevent shadowing stdlib in gzip/tarfile/zipfile CLI during extraction
When tarfile or zipfile command line interface (CLI) is used to decompress an archive, a Python script shadowing the stdlib can be created. Then if an error occurs during decompressing the next file, the newly created Python script is executed. This is especi…
-
High 8.5
Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server befo…
-
Medium 5.4
Uncontrolled search path for some Intel(R) Graphics Software before version 26.14.2303.1 within Ring 3: User Applicatio…
-
Medium 6.5
Akamai CLI before 2.0.6 Path Traversal via cli.json Command Names
Akamai CLI before 2.0.6 contains a path traversal vulnerability that allows malicious packages to write files outside the install directory via unvalidated commands[].name values in cli.json. Attackers who convince victims to install or update a package can u…
-
Medium 5.4
Uncontrolled search path for the libva software for all versions within Ring 3: User Applications may allow an escalati…
-
Medium 4.8
Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User A…
-
High 8.3
Out-of-bounds write for some Intel(R) Performance Counter Monitor (Intel(R) PCM) within Ring 3: User Applications may a…
-
Medium 4.8
Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User A…
-
Medium 5.4
Uncontrolled search path for some Intel(R) Application Optimization User Interface within Ring 3: User Applications may…
-
Medium 5.8
Integer overflow to buffer overflow for some Intel(R) oneAPI Deep Neural Network Library (oneDNN) software before versi…
-
Medium 4.8
Uncaught exception for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applications may…
-
Medium 4.8
Deserialization of untrusted data for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User A…
-
Medium 5.9
Improper certificate validation for some Intel(R) TDX Workload Attestation software within Ring 3: User Applications ma…
-
Medium 4.8
Improper input validation for some Intel(R) Neural Compressor software before version 3.8 within Ring 3: User Applicati…
-
Medium 6.8
Improper resource locking for the Intel(R) NPU Drivers before version 32.0.100.4778 within Ring 1: Device Drivers may a…
-
Medium 5.4
Protection mechanism failure for some Intel Neural Compressor software before version master within Ring 3: User Applic…
-
Medium 6.0
Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5
Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon (`max_uses` / `max_customer_uses` = 1), on more…