GHSA-46CM-PFWV-CGF8 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization...

PYSEC-2024-316

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

CVE-2024-31492

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2024-20759 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce versions 2.4.6-p4, 2.4.5-p6, 2.4.4-p7, 2.4.7-beta3 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a...

unbound security update

1.16.2-3.5 - Rebuilt again with z-stream target 1.16.2-3.4 - Correct typo in new config file 1.16.2-3.3 - Ensure group access correction reaches also updated configs CVE-2024-1488 1.16.2-3.2 - Ensure only unbound group can change configuration CVE-2024-1488...

PT-2024-22934

Name of the Vulnerable Software and Affected Versions BerriAI/litellm affected versions not specified Description The issue arises from the hf chat template method processing the chat template parameter from the tokenizer config.json file through the Jinja template engine without proper...

FortiClientMac 安全漏洞

Fortinet FortiClientMAC is a security tool for the macOS platform from Fortinet, Inc. A security vulnerability exists in FortiClientMac versions 7.2.3 and earlier, 7.0.10 and earlier, which stems from a vulnerability that could allow a local attacker to execute arbitrary code or commands by writi...

PT-2024-19255 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt affected versions not specified Description: The issue is related to improper access control, allowing unauthorized access to the config.json file. This affects both authenticated and unauthenticated versions of the...

Description of the security update for SharePoint Server 2019: April 9, 2024 (KB5002580)

None None...

SUSE CVE-2024-26691

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix circular locking dependency The rule inside kvm enforces that the vcpu-mutex is taken inside kvm-lock. The rule is violated by the pkvmcreatehypvm which acquires the kvm-lock while already holding the vcpu-mutex...

CVE-2024-3456

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/configAnticrack.php. The manipulation of the argument GroupId leads to sql injection. The attack may be launched...

PT-2024-2865 · Totolink · Totolink Ex200

Name of the Vulnerable Software and Affected Versions: TOTOLINK EX200 version 4.0.3c.7646 B20201211 Description: The issue is related to the getWiFiExtenderConfig function, which can allow an attacker to obtain sensitive information without authorization. This can be exploited by a remote attacke...

PT-2024-25985 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical vulnerability has been found in the Netentsec NS-ASG Application Security Gateway. This issue affects an unknown part of the file /admin/config...

DataEase 安全漏洞

DataEase is an open source data visualization and analysis tool. Used to help users quickly analyze data and gain insight into business trends , so as to achieve business improvement and optimization . A security vulnerability exists in DataEase versions prior to 2.5.0. Attackers can use this...

Netentsec NS-ASG Application Security Gateway SQL注入漏洞

NetentSec NS-ASG Application Security Gateway is an application security gateway from China NetentSec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from a SQL injection vulnerability in the parameter GroupId in the file...

Netentsec NS-ASG Application Security Gateway SQL注入漏洞

NetentSec NS-ASG Application Security Gateway is an application security gateway from China NetentSec. A SQL injection vulnerability exists in Netentsec NS-ASG Application Security Gateway version 6.3, which originates from a SQL injection vulnerability in the parameter GroupId in the file...

TOTOLINK EX200 安全漏洞

TOTOLINK EX200 is a wireless N range extender from China Gion Electronics TOTOLINK , which is mainly used to extend the coverage of the existing Wi-Fi network and solve the problem of signal blind zones. TOTOLINK EX200 suffers from an information disclosure vulnerability that stems from improper...

CVE-2024-3376

A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file config.php. The manipulation of the argument url leads to execution after redirect. It is possible to initiate the attack remotely. The explo...

GO-2024-2683 Improper handling of node names in JWT claims assertions in github.com/hashicorp/consul

HashiCorp Consul does not properly validate the node or segment names prior to interpolation and usage in JWT claim assertions with the auto config RPC...

CVE-2024-26810

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Lock external INTx masking ops Mask operations through config space changes to DisINTx may race INTx configuration changes via ioctl. Create wrappers that add locking for paths outside of the core interrupt code. In...