PYSEC-2024-73

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

CVE-2024-6255 Path Traversal in gaizhenbiao/chuanhuchatgpt

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

CVE-2024-6255 Path Traversal in gaizhenbiao/chuanhuchatgpt

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

CVE-2024-6255 Path Traversal in gaizhenbiao/chuanhuchatgpt

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as config.json and dsconfigchatbot.json. This issue arises due to improper validation of file paths, enabling...

SUSE SLES15: kubevirt-container-disk / kubevirt-manifests / etc (SUSE-SU-2024:2639-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2639-1 advisory. - Update to version 1.2.2 Release notes https://github.com/kubevirt/kubevirt/releases/tag/v1.2.2 Release notes...

PT-2024-41003 · Kubevirt · Kubevirt

Name of the Vulnerable Software and Affected Versions: kubevirt versions prior to 1.2.2 Description: The issue is related to kubevirt and its associated containers, including virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container,...

CVE-2024-41817

ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The AppImage version ImageMagick might use an empty path when setting MAGICKCONFIGUREPATH and LDLIBRARYPATH environment variables while executing, which might lead to arbitrary code execution b...

c-ares: Out of bounds read in ares__read_line()

A vulnerability was found in c-ares where the aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.22.0, the /etc/hosts file. If the configuration files have an embedded NULL character ...

CVE-2024-1575

The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70ACGG.3 and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device...

CVE-2024-1575

The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70ACGG.3 and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device...

CVE-2024-1575

The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70ACGG.3 and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device...

CVE-2024-1575

CVE-2024-1575 affects Zyxel WBE660S, specifically firmware 6.70(ACGG.3) and earlier. The issue is improper privilege management that can let an authenticated user escalate privileges and download configuration files from the device (impacting confidentiality). Reported attack vector is network wi...

CUPS < 2.4.9 File Permission Vulnerability

CUPS is prone to a file permission vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:openprinting:cups"; if...

c-ares: Out of bounds read in ares__read_line()

A vulnerability was found in c-ares where the aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.22.0, the /etc/hosts file. If the configuration files have an embedded NULL character ...

The vulnerability of the SCADA system “ENTEK,” which stems from the storage of critical information in an open manner, allows a intruder to gain unauthorized access to the protected information.

The vulnerability of the SCADA system “ENTEK” is related to the storage of critical information in an open manner. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information by intercepting traffic or obtaining configuration...

How to Configure an External SSL Certificate for XenMobile Device Manager 9.0

This article provides information on how to configure an external SSL Certificate for XenMobile Device Manager XDM. The procedure in this article should be used during new installations or certificate renewals with the same FQDN – new installations that are set up with internal self-signed...

GO-2024-2519 Grafana world readable configuration files in github.com/grafana/grafana

Grafana world readable configuration files in github.com/grafana/grafana. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

CVE-2024-4836

Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versio...

CVE-2024-4836

Edito CMS Web services expose a sensitive data leak in versions 3.5–3.25 by allowing unauthenticated download of configuration files. The issue was fixed in releases after January 10, 2014; higher versions were never affected. Remediation: update to a version later than 3.25. No exploitation deta...

Edito CMS Security Vulnerability

Edito CMS is a comprehensive framework from Edito Inc. that can improve the management of websites and portals. A security vulnerability exists in Edito CMS versions 3.25 through 3.5 that stems from allowing unauthenticated users to download configuration files...