Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses …
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc grpc_core and grpc allows unauthenticated attackers to exhaust server memory via a compressed Erlang exte…
Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted…
A buffer overflow in handling EDID Display-Range descriptors in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by malicious monitors to crash the x server or execute cote.
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via …
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated us…
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targete…
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, includi…
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via…
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability, potentially leading to privilege escalation…
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locat…
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.
CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake…
xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply …
xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file t…
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights.…
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40,…
Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703)…
OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26,…
Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 …