CVE database
94,291 vulnerabilities, newest first. Each page breaks the severity score down in plain language and lists affected versions, exploitation status and the fix.
- 7.8 High severity
Ultralytics: Deserialization of Untrusted Data
Ultralytics load_dataset_cache_file Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit th
- 7.8 High severity
Ultralytics: Improper Control of Generation of Code
Ultralytics parse_model Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that the ta
- 7.8 High severity
Ultralytics: Improper Neutralization of Special Elements used in an OS Command
Ultralytics torch_safe_load Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that
- 7.8 High severity
Ultralytics: Improper Control of Generation of Code
Ultralytics check_det_dataset Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerability in that
- 7.8 High severity
Ultralytics: Deserialization of Untrusted Data
Ultralytics torch_load Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ultralytics. User interaction is required to exploit this vulnerabil
- 8.8 High severity
iLX-F511: Stack-based Buffer Overflow
Alpine iLX-F511 Android Auto Service Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not req
- 8.8 High severity
iLX-F511: Exposed Dangerous Method or Function
Alpine iLX-F511 Framework Service Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. Authentication is not require
- 8.0 High severity
iLX-F511: Stack-based Buffer Overflow
Alpine iLX-F511 prh_sdp_service_search_decode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine iLX-F511 devices. An attacker must
- 8.0 High severity
iLX-F511: Stack-based Buffer Overflow
Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected Alpine iLX-F511 devices. User interaction is required to exploit this vuln
- 7.8 High severity
iLX-F511: Exposed Dangerous Method or Function
Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Alpine iLX-F511. An attacker must first obtain the ability to execute lo
- 8.8 High severity
Laravel MongoDB: Access of Resource Using Incompatible Type
A type-handling flaw in the relationship query building of this MongoDB integration library can cause a check for the absence of a related record to be compiled with an identifier of the wrong data type. In an application that relies on such a check to decide
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values, allowing attackers to bypass
- 8.8 High severity
Jenkins: Improper Control of Generation of Code
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account in
- 8.1 High severity
Jenkins: Session Fixation
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins
- 8.1 High severity
Jenkins: Concurrent Execution using Shared Resource with Improper Synchronization
In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administra
- 8.1 High severity
Jenkins: Improper Link Resolution Before File Access
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or em
- 8.8 High severity
Jenkins: Improper Limitation of a Pathname to a Restricted Directory
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configurat
- 8.8 High severity
Jenkins: Missing Authorization
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers
- 8.8 High severity
Jenkins: Deserialization of Untrusted Data
Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization.
- 8.1 High severity
Apache Kafka: Exposure of Sensitive Information to an Unauthorized Actor
Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate connector configurations. Apache Kafka Connect also support Configuration Providers which enable to hide the values of sensitive configuration
- 8.8 High severity
Apache Kafka: Authentication Bypass Using an Alternate Path or Channel
Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners is configured with a separate listener from the main listeners property. When operators isolate the admin REST API by explicitly configuring
- 7.5 High severity
Several Kafka deserialization paths read a size or count field from input data and use it…
Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an array, collection, or byte buffer, with no check against the bytes actually available. A small crafted input can therefore declare a very large si
- 9.1 Critical severity
Apache Kafka: Integer Overflow or Wraparound
Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advanc
- 9.1 Critical severity
Apache Kafka: Allocation of Resources Without Limits or Throttling
Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.byt
- 9.1 Critical severity
Apache Kafka: Uncontrolled Resource Consumption
Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most el
- 9.1 Critical severity
Apache Kafka: Insufficient Verification of Data Authenticity
A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature.
- 8.8 High severity
Session Smart Router: Improper Neutralization of Special Elements used in an OS Command
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitra
- 8.9 High severity
Grafana Enterprise: Improper Authorization
An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required permissions (missing authorization). This affects Grafana OSS and Enterprise 13.2 installations with the experimental kubernetesSsoSettingsA
- 7.1 High severity
Session Smart Router: Integer Underflow (Wrap or Wraparound)
An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply.
- 7.5 High severity
Session Smart Router: Integer Overflow or Wraparound
An Integer Overflow vulnerability in the DPI certificate scanner in Juniper Networks Session Smart Router allows an unauthenticated remote attacker to cause a denial of service via a specially crafted TLS server certificate.
- 9.8 Critical severity
Session Smart Router: Missing Authentication for Critical Functionality
A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root
- 8.8 High severity
Session Smart Router: Stack-based Buffer Overflow
A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply.
- 8.8 High severity
Session Smart Router: Improper Limitation of a Pathname to a Restricted Directory
An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key fi
- 9.8 Critical severity
Session Smart Conductor: Improper Neutralization of Special Elements used in an OS Command
An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.
- 8.8 High severity
Session Smart Router: Improper Neutralization of Special Elements used in an OS Command
An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrar
- 8.8 High severity
Session Smart Router: Insufficient Verification of Data Authenticity
An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via
- 8.8 High severity
Session Smart Router: Improper Link Resolution Before File Access
An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as roo
- 7.7 High severity
Grafana Enterprise: Incorrect Authorization
A user with permission to edit contact points but not their protected fields can change protected settings, such as a contact point's destination URL, by switching an integration to a legacy schema version, which can expose stored credentials and redirect aler
- 7.8 High severity
xorg-x11-server: Heap-based Buffer Overflow
A heap buffer overflow caused by mismatched size usage in CopyArea CPU-to-FBO path in X.Org X Server before 21.1.15 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in the X server context.
- 7.8 High severity
xorg-x11-server: Heap-based Buffer Overflow
A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context.