Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

Summary knowledgeBase.removeFilesFromKnowledgeBase tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. Details userId filter in the database query is commented out, so it's enabling attackers to delete other users' KB files if they know the...

Server-Side Request Forgery (SSRF)

Umbraco CMS is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of the baseUrl parameter in dashboard and help controller endpoints, which allows an attacker to craft requests that force the server to make unauthorized requests to external hosts...

CVE-2025-59355

A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.errorstr + "decode failed", e. If the input parameter contains sensitive information such as Hive Metastore keys, plaintext...

Denial Of Service (DoS)

Devalue is vulnerable to a Denial-Of-Service DoS.The vulnerability is due to missing input validation during ArrayBuffer hydration, where devalue.parse assumes base64-encoded input without verification, allowing crafted data to trigger excessive CPU and memory consumption when parsing untrusted...

MiracleLinux 8 : gstreamer1-plugins-base-1.16.1-3.el8 (AXSA:2024-8315:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8315:02 advisory. gstreamer-plugins-base: heap overwrite in subtitle parsing CVE-2023-37328 Tenable has extracted the preceding description block directly from the MiracleLinu...

MiracleLinux 7 : 389-ds-base-1.3.10.2-17.el7 (AXSA:2022-3917:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3917:03 advisory. 389-ds-base: SIGSEGV in syncrepl CVE-2022-2850 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...

MiracleLinux 7 : 389-ds-base-1.3.11.1-5.el7 (AXSA:2024-8119:05)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8119:05 advisory. 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request CVE-2024-3657 389-ds-base: Malformed userPassword may cause...

MiracleLinux 8 : gstreamer1-plugins-base-1.16.1-5.el8_10 (AXSA:2024-9435:04)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9435:04 advisory. gstreamer1-plugins-base: GStreamer has a stack-buffer overflow in vorbishandleidentificationpacket CVE-2024-47538 gstreamer1-plugins-base:...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2022-3797:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3797:01 advisory. 389-ds-base: sending crafted message could result in DoS CVE-2022-0918 389-ds-base: expired password was still allowed to access the database...

MiracleLinux 9 : gstreamer1-plugins-base-1.22.1-2.el9 (AXSA:2024-8035:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8035:01 advisory. gstreamer-plugins-base: heap overwrite in subtitle parsing CVE-2023-37328 Tenable has extracted the preceding description block directly from the MiracleLinu...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2022-3938:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3938:01 advisory. 389-ds-base: SIGSEGV in syncrepl CVE-2022-2850 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory. Note...

MiracleLinux 8 : qt5-qtbase-5.15.3-8.el8_10 (AXSA:2024-8583:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8583:03 advisory. qtbase: qtbase: Delay any communication until encrypted can be responded to CVE-2024-39936 Tenable has extracted the preceding description block directly fro...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2024-8413:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8413:01 advisory. 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars in logentryattr CVE-2024-1062 Tenable has extracted the...

MiracleLinux 9 : qt5-qtbase-5.15.9-9.el9 (AXSA:2024-8076:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8076:01 advisory. qt: incorrect integer overflow check CVE-2023-51714 qtbase: potential buffer overflow when reading KTX images CVE-2024-25580 Tenable has extracted t...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2021-2352:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2352:01 advisory. 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed CVE-2021-3652 Tenable has extracted the preceding description block directl...

MiracleLinux 9 : 389-ds-base-2.1.3-4.el9 (AXSA:2023-4906:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-4906:01 advisory. 389-ds-base: sending crafted message could result in DoS CVE-2022-0918 389-ds-base: SIGSEGV in syncrepl CVE-2022-2850 389-ds-base: expired password...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2021-1657:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1657:01 advisory. 389-ds-base: information disclosure during the binding of a DN CVE-2020-35518 Tenable has extracted the preceding description block directly from the...

MiracleLinux 8 : qt5-qtbase-5.15.2-4.el8.ML.1 (AXSA:2022-3605:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3605:01 advisory. qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke CVE-2021-38593 Tenable has extracted t...

MiracleLinux 7 : 389-ds-base-1.3.10.2-12.el7 (AXSA:2021-1847:03)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1847:03 advisory. 389-ds-base: information disclosure during the binding of a DN CVE-2020-35518 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : 389-ds-base-2.4.5-9.el9_4 (AXSA:2024-8654:07)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8654:07 advisory. 389-ds-base: Malformed userPassword hash may cause Denial of Service CVE-2024-5953 389-ds-base: unauthenticated user can trigger a DoS by sending a...