Filtered by CWE-1287
Filtered by vendor Subscriptions
Total 152 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-31948 1 Frrouting 1 Frrouting 2025-11-04 6.5 Medium
In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash.
CVE-2024-5594 1 Openvpn 1 Openvpn 2025-11-04 9.1 Critical
OpenVPN before 2.6.11 does not santize PUSH_REPLY messages properly which an attacker controlling the server can use to inject unexpected arbitrary data ending up in client logs.
CVE-2024-4879 1 Servicenow 1 Servicenow 2025-11-03 9.8 Critical
ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.
CVE-2025-58084 1 Mattermost 2 Mattermost, Mattermost Desktop 2025-10-29 3.5 Low
Mattermost Desktop App versions <= 5.13.0 fail to validate URLs external to the configured Mattermost servers, allowing an attacker on a server the user has configured to crash the user's application by sending the user a malformed URL.
CVE-2024-42189 1 Hcltech 1 Bigfix Platform 2025-10-09 6.5 Medium
HCL BigFix Web Reports might be subject to a Denial of Service (DoS) attack, due to a potentially weak validation of an API parameter.
CVE-2025-20033 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-02 4.3 Medium
Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.
CVE-2025-8402 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 4.9 Medium
Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.0, 10.9.x <= 10.9.3 fail to validate import data which allows a system admin to crash the server via the bulk import feature.
CVE-2025-41395 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks plugin, which allows an attacker to create a specially crafted post with maliciously crafted props and cause a denial of service (DoS) of the web app for all users.
CVE-2025-20088 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVE-2025-20621 1 Mattermost 2 Mattermost, Mattermost Server 2025-10-01 6.5 Medium
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.
CVE-2024-12756 1 Avaya 1 Spaces 2025-10-01 7.3 High
An HTML Injection vulnerability in Avaya Spaces may have allowed disclosure of sensitive information or modification of the page content seen by the user.
CVE-2025-20086 1 Mattermost 2 Mattermost, Mattermost Server 2025-09-30 6.5 Medium
Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVE-2024-54083 1 Mattermost 2 Mattermost, Mattermost Server 2025-09-30 6.5 Medium
Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a specially crafted post.
CVE-2025-1558 1 Mattermost 1 Mattermost Mobile 2025-09-25 6.5 Medium
Mattermost Mobile Apps versions <=2.25.0 fail to properly validate GIF images prior to rendering which allows a malicious user to cause the Android application to crash via message containing a maliciously crafted GIF.
CVE-2025-21083 1 Mattermost 1 Mattermost Mobile 2025-09-25 6.5 Medium
Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVE-2025-20036 1 Mattermost 1 Mattermost Mobile 2025-09-25 6.5 Medium
Mattermost Mobile Apps versions <=2.22.0 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.
CVE-2025-0476 1 Mattermost 1 Mattermost Mobile 2025-09-24 4.3 Medium
Mattermost Mobile Apps versions <=2.22.0 fail to properly handle specially crafted attachment names, which allows an attacker to crash the mobile app for any user who opened a channel containing the specially crafted attachment
CVE-2025-20630 1 Mattermost 1 Mattermost Mobile 2025-09-24 6.5 Medium
Mattermost Mobile versions <=2.22.0 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the mobile to crash via creating and sending such a post to a channel.
CVE-2025-54525 1 Mattermost 2 Confluence, Mattermost 2025-09-24 7.5 High
Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.
CVE-2021-32024 1 Blackberry 1 Qnx Software Development Platform 2025-09-09 8.1 High
A remote code execution vulnerability in the BMP image codec of BlackBerry QNX SDP version(s) 6.4 to 7.1 could allow an attacker to potentially execute code in the context of the affected process.