Insecure Temporary File

Overview greenbids-tailor is a Bring traffic shaping to your own cloud Affected versions of this package are vulnerable to Insecure Temporary File due to the use of a world-writable directory /tmp for the download lock file greenbids-tailor-download.lock. This setup could allow local attackers wi...

Langchain Path Traversal vulnerability

A path traversal vulnerability exists in the getFullPath method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The vulnerability is exploited through the...

CVE-2024-8309

A vulnerability in the GraphCypherQAChain class of langchain-ai/langchain version 0.2.5 allows for SQL injection through prompt injection. This vulnerability can lead to unauthorized data manipulation, data exfiltration, denial of service DoS by deleting all data, breaches in multi-tenant securit...

PT-2024-40897 · Unknown · Langchainjs

Name of the Vulnerable Software and Affected Versions: langchainjs version 0.2.5 Description: A path traversal issue exists, allowing attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. This is exploited through the setFileContent,...

LangChain.js 安全漏洞

LangChain.js is a build context-aware reasoning application open-sourced by LangChain. A security vulnerability exists in LangChain.js version 0.2.5, which stems from the presence of a path traversal vulnerability that allows an attacker to save a file, overwrite an existing text file, read a fil...

PT-2024-38570 · Langchain Ai · Langchainjs

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchainjs version 0.2.5 Description: A path traversal issue exists in the getFullPath method, allowing attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt files, and delete files. The...

PT-2024-33378 · Agustin Berasategui · Ab Categories Search Widget

Name of the Vulnerable Software and Affected Versions: Agustin Berasategui AB Categories Search Widget versions 0.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS...

Huawei EulerOS: Security Advisory for libyaml (EulerOS-SA-2024-2242)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

key-serializer security vulnerability

key-serializer is a library by Harvey Woo Personal Developer. It is used to serialize keys and query keys deep within objects. A security vulnerability exists in key-serializer version 0.2.5, which stems from a function containing prototype contamination that allows an attacker to execute arbitra...

CVE-2024-35325

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2024-35325

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2024-35328

...

PT-2024-26434 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml version 0.2.5 Description: The issue is related to a Buffer Overflow vulnerability. It affects the yaml emitter emit function in the /src/libyaml/src/emitter.c file. The manipulation leads to a double-free. Recommendations: For libyam...

PT-2024-26433 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml versions up to 0.2.5 Description: A vulnerability was found in libyaml, affecting the function yaml event delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. Recommendations: For libyaml versions up to...

PT-2024-26435 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml version 0.2.5 Description: The issue affects the function yaml parser parse of the file /src/libyaml/src/parser.c, making libyaml vulnerable to Denial of Service DDOS attacks. Recommendations: As a temporary workaround, consider...

CVE-2024-35329

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

WordPress plugin MM-email2image 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress MM-email2image plugin <= 0.2.5 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin MM-email2image versions = 0.2.5...

PT-2024-24377 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml versions up to 0.2.5 Description: A critical vulnerability was found in libyaml, affecting the yaml emitter emit flow sequence item function. This issue leads to a heap-based buffer overflow and may be exploited remotely. The exploit...

phonenumber panics on parsing crafted RFC3966 inputs

Impact The phonenumber parsing code may panic due to a panic-guarded out-of-bounds access on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber over the network, specifically the string .;phone-context=. Patches...