CVE-2024-43805

CVE-2024-43805 affects JupyterLab and Jupyter Notebook where a user opens a malicious notebook or Markdown file in preview mode can lead to data access and arbitrary requests performed as the attacked user. Affected versions include JupyterLab v3.6.8, v4.2.5 and Jupyter Notebook v7.2.2; patches e...

CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user c...

CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user c...

The vulnerability of the Apache Traffic Server web server, related to insufficient input validation, allows attackers to execute arbitrary requests.

The vulnerability of the Apache Traffic Server web server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary requests using the HTTP Accept-Encoding header...

WonderCMS 安全漏洞

WonderCMS is a PHP-based open source content management system CMS from WonderCMS. A server-side request forgery vulnerability exists in WonderCMS version 3.4.3, which stems from a failure to properly validate user input in the Plugins Page, and can be exploited by an attacker to force the...

CVE-2024-41305

WonderCMS v3.4.3 contains a Server-Side Request Forgery (SSRF) in the Plugins Page disclosed across multiple sources. The vulnerability arises from unvalidated input in the pluginThemeUrl parameter, enabling an attacker to coerce the application into making arbitrary outgoing requests. Impact det...

CVE-2024-41305

A Server-Side Request Forgery SSRF in the Plugins Page of WonderCMS v3.4.3 allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the pluginThemeUrl parameter...

PT-2024-29274 · Pypi · Streamlit-Geospatial

Name of the Vulnerable Software and Affected Versions: streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489 Description: The issue allows for blind server-side request forgery due to the url variable taking user input, which is then used by the get wms layer meth...

U.S. Dept Of Defense: XSS on ███████

The report describes an XSS vulnerability found on the ████████ website. The vulnerability was triggered by visiting a specific URL with a crafted parameter. The impact of the vulnerability was that it could allow an attacker to execute arbitrary JavaScript code in the victim's browser...

CVE-2023-31456

There is an SSRF vulnerability in the Fluid Topics platform that affects versions prior to 4.3, where the server can be forced to make arbitrary requests to internal and external resources by an authenticated user...

CVE-2024-4499

CVE-2024-4499 describes a CSRF vulnerability in the XTTS server of parisneo/lollms 9.6 caused by a lax CORS policy. An attacker can lure a user to a malicious page to trigger arbitrary LoLLMS-XTTS API requests, potentially leading to reading/writing of audio files and, in combination with other i...

CVE-2024-1855

The WPCafe – Restaurant Menu, Online Ordering for WooCommerce, Pickup / Delivery and Table Reservation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.2.23 via the wpccheckforsubmission function. This makes it possible for unauthenticated...

PT-2024-34825 · Prodys · Quantum Audio Codec

Name of the Vulnerable Software and Affected Versions: Prodys' Quantum Audio codec versions 2.3.4t and below Description: The issue is related to improper access control, allowing an unauthenticated user to bypass authentication and execute arbitrary API requests against the web application...

CVE-2024-4561

In WhatsUp Gold versions released before 2023.1.2 , a blind SSRF vulnerability exists in Whatsup Gold's FaviconController that allows an attacker to send arbitrary HTTP requests on behalf of the vulnerable server...

U.S. Dept Of Defense: reflected xss [CVE-2020-3580]

The application was vulnerable to cross-site scripting XSS due to insufficient input validation. This allowed an attacker to inject malicious scripts that could be executed in the victim's browser...

Relate Cross Site Scripting

Exploit Title: Relate Learning And Teaching system Version before 2024.1 Stored XSS Date: 18/04/2024 Exploit Author: kai6u Vendor Homepage: https://github.com/inducer/ Software Link: https://github.com/inducer/relate Affected Version:before 2024.1...

Plane 安全漏洞

Plane is an open source, self-hosted project planning tool from Plane Open Source. A security vulnerability exists in versions prior to Plane 0.17-dev, which stems from a vulnerability that allows an attacker to send arbitrary requests to the server hosting the application, resulting in...

The vulnerability of the Codeium-Chrome plugin, related to the lack of protection for service data, allows a hacker to send arbitrary requests to the internal filling server on behalf of another user.

The vulnerability of Codeium-Chrome is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor to send arbitrary requests to the internal filling server on behalf of another user...

BIT-GITLAB-2022-3060

Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests...

BIT-LIVEHELPERCHAT-2022-1213

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191...