405,004 results · Feed
-
High 7.5
An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a …
-
High 8.7
Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
High 8.1
A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, includin…
-
High 8.2
A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TL…
-
Medium 6.3
REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in th…
-
High 8.7
Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerabili…
-
Low 2.9
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…
-
Low 2.5
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process i…
-
Medium 5.1
OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to …
-
Medium 5.3
OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post comme…
-
Medium 5.3
OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make…
-
Critical 9.3
OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obt…
-
High 8.7
OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers…
-
Medium 5.3
OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an i…
-
Medium 5.3
OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hi…
-
Low 3.7
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Medium 5.9
A one-byte heap buffer overflow in Node.js HTTP/2 Alt-Svc handling lets a remote, unauthenticated attacker corrupt proc…
-
High 7.2
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Low 3.1
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Low 3.7
Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of de…
-
Medium 4.9
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Medium 4.3
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
High 7.5
Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a vulnerability that may cause sensitive au…
-
High 8.9
Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulner…
-
High 8.7
aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution
aeon is a scikit-learn compatible Python library for learning from time series. Prior to version 1.5.0, a GitHub Actions workflow used pull_request_target for pre-commit checks on pull requests from forks. In this configuration, fork-controlled code could be …
-
Medium 5.3
vulnerability-operator: IDOR exposing vulnerability reports via unauthenticated Report Handler
vulnerability-operator scans SBOMs and Images for vulnerabilities. Prior to version 0.28.16, an unauthenticated information-disclosure vulnerability exposes all vulnerability scan reports served by the operator. The /report/ HTTP endpoint mounts a raw http.Fi…
-
High 7.4
Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability …
-
High 8.8
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an external control of a system configuration settin…
-
High 8.8
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewa…
-
Medium 6.3
In Progress® Telerik® Report Server prior to version 12.3.26.1110, an incorrect authorization vulnerability in the Web …
-
Medium 5.4
A stored cross-site scripting vulnerability in maintenance-appendcode-check.php in Revive Adserver 6.0.8 and earlier al…
-
Medium 4.3
An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to cre…
-
Medium 4.3
A cross-site request forgery vulnerability in tracker-invocation.php in Revive Adserver 6.0.8 and earlier allows an att…
-
Medium 6.1
A stored cross-site scripting vulnerability in the report date-selection controls of Revive Adserver 6.0.8 and earlier …
-
Medium 6.1
A reflected cross-site scripting vulnerability in the iframe invocation options of Revive Adserver 6.0.8 and earlier al…
-
Medium 4.7
A reflected cross-site scripting vulnerability in the invocation-tag generation interface of Revive Adserver 6.0.8 and …
-
High 8.1
An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency…
-
High 8.8
Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to ex…
-
Medium 4.7
A reflected cross-site scripting vulnerability in the popup invocation options of Revive Adserver 6.0.8 and earlier all…
-
Medium 6.1
A reflected cross-site scripting vulnerability in the conversion-statistics pages of Revive Adserver 6.0.8 and earlier …