9623 matches found
CVE-2018-6846
Z-BlogPHP 1.5.1 allows remote attackers to discover the full path via a direct request to zbsystem/function/lib/upload.php...
CVE-2018-19620
ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified pageid...
CVE-2018-4365
An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12.1...
CVE-2018-4347
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, iTunes 12.9 for Windows, iCloud for Windows 7.7...
CVE-2018-4421
A memory initialization issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.1...
CVE-2009-4375
SQL injection vulnerability in repository/repositoryattachment.php in AlienVault Open Source Security Information Management OSSIM 2.1.5, and possibly other versions before 2.1.5-4, allows remote attackers to execute arbitrary SQL commands via the iddocument parameter...
CVE-2001-1549
Tiny Personal Firewall 1.0 and 2.0 allows local users to bypass filtering via non-standard TCP packets created with non-Windows protocol adapters...
CVE-2003-1512
Buffer overflow in mIRC 6.1 and 6.11 allows remote attackers to cause a denial of service crash via a long DCC SEND request...
CVE-2021-41636
MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply...
CVE-2021-27367
Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal...
CVE-2021-33834
An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00. When handling IOCTL 0x22229a, the input used to allocate a buffer and copy memory is mishandled. This could cause memory corruption or a system crash...
CVE-2021-28680
The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...
CVE-2021-31910
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible...
CVE-2021-0103
Insufficient control flow management in the firmware for some IntelR Processors may allow a privileged user to potentially enable an escalation of privilege via local access...
CVE-2021-0090
Uncontrolled search path element in IntelR DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access...
CVE-2021-0193
Improper authentication in the IntelR In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access...
EUVD-2026-1743
The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2016-10740
Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources...