CVE-2024-5824

A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...

CVE-2024-5824 Path Traversal in parisneo/lollms

A path traversal vulnerability in the /setpersonalityconfig endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as forceacceptremoteaccess and...

MAL-2024-2014 Malicious code in @expue/config (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-36471 Apache Allura: sensitive information exposure via DNS rebinding

Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allura from 1.0.1 through 1.16.0. Users are...

jenkins-2-plugins: matrix-project plugin path traversal vulnerability

A flaw was found in The Matrix Project Plugin for Jenkins, which does not sanitize user-defined axis names of multi-configuration projects submitted through the config.xml REST API endpoint. This issue may allow attackers with Item/Configure permission to create or replace any config.xml file on...

CVE-2022-28652

/.config/apport/settings parsing is vulnerable to "billion laughs" attack...

PT-2024-26442 · Anpviz · Anpviz

Name of the Vulnerable Software and Affected Versions: Anpviz products versions 3.2.2.2 and lower Description: The issue allows unauthenticated users to download the running configuration of the device via a HTTP GET request to "/ConfigFile.ini" or "/config.xml" URIs. This configuration file...

Open Library Foundation VuFind 安全漏洞

Open Library Foundation VuFind is an open source library resource discovery Discovery system from the Open Library Foundation. A security vulnerability exists in Open Library Foundation VuFind version 2.0 through versions prior to 9.1.1, which stems from the presence of a server-side request...

Westermo EDW-100 安全漏洞

The Westermo EDW-100 is a serial Ethernet converter from Westermo Sweden. A security vulnerability exists in the Westermo EDW-100 version 2024-05-03 and earlier, which originates from allowing an unauthenticated user to download a configuration file containing a password in clear text...

Meinberg LANTIME Improper Filename Validation of the Upload Function (CVE-2023-1731)

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands. This plugin only works with Tenable.ot. Please visit...

CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

CVE-2023-46304

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

CVE-2024-3625 Mirror-registry: redis password stored in plain-text

A flaw was found in Quay, where Quay's database is stored in plain text in mirror-registry on Jinja's config.yaml file. This issue leaves the possibility of a malicious actor with access to this file to gain access to Quay's Redis instance...

Ruijie Networks RG-RSR10-01G-T 安全漏洞

The Ruijie Networks RG-RSR10-01G-T is a wireless router from Ruijie Networks China. A security vulnerability exists in the RG-RSR10-01G-TW-S and RG-RSR10-01G-TWA-S, which originated from a vulnerability that allows an attacker to execute arbitrary code via the commonquickconfig.loa file. Affected...

PYSEC-2024-316

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

unbound security update

1.16.2-3.5 - Rebuilt again with z-stream target 1.16.2-3.4 - Correct typo in new config file 1.16.2-3.3 - Ensure group access correction reaches also updated configs CVE-2024-1488 1.16.2-3.2 - Ensure only unbound group can change configuration CVE-2024-1488...

FortiClientMac 安全漏洞

Fortinet FortiClientMAC is a security tool for the macOS platform from Fortinet, Inc. A security vulnerability exists in FortiClientMac versions 7.2.3 and earlier, 7.0.10 and earlier, which stems from a vulnerability that could allow a local attacker to execute arbitrary code or commands by writi...

PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...

Description of the security update for SharePoint Server 2019: April 9, 2024 (KB5002580)

None None...

PT-2024-25985 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical vulnerability has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file /admin/config...