CVE-2024-37143

Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 for RCM 3.8.x train and prior to RCM 3.7.6.0 for RCM 3.7.x train, Dell PowerFlex custom node using PowerFlex Manager versions prior to 4.6.1.0, Dell InsightIQ versions prior...

CVE-2023-27195

Trimble TM4Web 22.2.0 allows unauthenticated attackers to access /inc/tmajax.msw?func=UserfromUUID&uuid= to retrieve the last registration access code and use this access code to register a valid account. via a PUT /inc/tmajax.msw request. If the access code was used to create an Administrator...

CGA-GF6X-W54G-9482

Bulletin has no description...

CVE-2024-7582

A vulnerability classified as critical was found in Tenda i22 1.0.0.34687. This vulnerability affects the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to buffer overflow. The attack can be initiated...

CGA-RV8W-7M8J-82GJ

Bulletin has no description...

CGA-MQF8-R2VP-3GCJ

Bulletin has no description...

CGA-RXR7-QJJ9-XF8J

Bulletin has no description...

CVE-2024-37895

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...

CVE-2024-37895

CVE-2024-37895 affects Lobe Chat, an open-source LLM/AI chat framework. In affected versions, if an attacker can authenticate via SSO/Access Code, they can modify the frontend base URL to point to a malicious attack URL and trigger a server-side request, enabling retrieval of the real backend API...

CVE-2024-37895 API Key Leak in lobe-chat

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...

PT-2024-27816

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 0.162.25 Description The issue allows an attacker to obtain the real backend API Key if they can successfully authenticate through SSO/Access Code. This is achieved by modifying the base URL to their own attack URL ...

CVE-2024-37895: Exposure of Sensitive Information to an Unauthorized Actor

Lobe Chat is an open-source LLMs/AI chat framework. In affected versions if an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. This issu...

CGA-QJG9-JJWV-XV5C

Bulletin has no description...

CGA-HH23-J43V-7RCP

Bulletin has no description...

CGA-R9QQ-3R2C-H7G5

Bulletin has no description...

CVE-2024-1417 Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute code under the context of the AuthPoint Password Manager application. This issue affects AuthPoint...

Trimble TM4Web 22.2.0 Privilege Escalation / Access Code Disclosure

CVE ID: CVE-2023-27195 Description: An access control issue in Trimble TM4Web v22.2.0 allows unauthenticated attackers to access a specific crafted URL path to retrieve the last registration access code and use this access code to register a valid account. If the access code was used to create an...

Trimble TM4Web 22.2.0 Privilege Escalation / Access Code Disclosure Vulnerability

An access control issue in Trimble TM4Web version 22.2.0 allows unauthenticated attackers to access a specific crafted URL path to retrieve the last registration access code and use this access code to register a valid account. If the access code was used to create an Administrator account,...

CVE-2024-23813

A vulnerability has been identified in Polarion ALM All versions V2404.0. The REST API endpoints of doorsconnector of the affected product lacks proper authentication. An unauthenticated attacker could access the endpoints, and potentially execute code...

GHSA-PF55-FJ96-XF37 @lobehub/chat vulnerable to unauthorized access to plugins

Description: When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. Proof-of-Concept: Let’s suppose that application has been deployed with following command: sudo docker run -d -p 3210:3210 -...