9691 matches found
CVE-2021-28680
The devisemasquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise without this extension is used. If the...
CVE-2021-31910
In JetBrains TeamCity before 2020.2.3, information disclosure via SSRF was possible...
CVE-2021-0103
Insufficient control flow management in the firmware for some IntelR Processors may allow a privileged user to potentially enable an escalation of privilege via local access...
CVE-2021-0090
Uncontrolled search path element in IntelR DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access...
CVE-2021-0193
Improper authentication in the IntelR In-Band Manageability software before version 2.13.0 may allow a privileged user to potentially enable escalation of privilege via network access...
EUVD-2026-1743
The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' variable in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...
CVE-2016-10740
Various resources in Atlassian Crowd before version 2.10.1 allow remote attackers with administration rights to learn the passwords of configured LDAP directories by examining the responses to requests for these resources...
CVE-2016-10929
The advanced-ajax-page-loader plugin before 2.7.7 for WordPress has no protection against the reading of uploaded files when not logged in...
CVE-2022-38302
Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/managedepartment.php...
CVE-2022-23456
Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software...
CVE-2022-37086
H3C H200 H200V100R004 was discovered to contain a stack overflow via the function AspSetTimingtimeWifiAndLed...
CVE-2022-31287
An issue was discovered in Bento4 v1.2. There is an allocation size request error in /Ap4RtpAtom.cpp...
CVE-2022-31335
Online Ordering System 2.3.2 is vulnerable to SQL Injection via /ordering/admin/stockin/index.php?view=edit=...
CVE-2022-26771
A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 8.6, tvOS 15.5, iOS 15.5 and iPadOS 15.5. A malicious application may be able to execute arbitrary code with kernel privileges...
CVE-2022-35052
OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1...
CVE-2022-35254
An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure ICS in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure IPS in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior...
CVE-2022-35039
OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0...
CVE-2022-35105
SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via /bin/png2swf+0x552cea...