CVE-2024-11602 CORS Vulnerability in feast-dev/feast

A Cross-Origin Resource Sharing CORS vulnerability exists in feast-dev/feast version 0.40.0. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can bypass intended security...

CVE-2024-10264 HTTP Request Smuggling in netease-youdao/qanything

HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP requests between a proxy and a server. This can lead to unauthorized access, bypassing security controls, session hijacking, data leakage, and...

CVE-2024-11821

CVE-2024-11821 affects langgenius/dify 0.9.1. The issue is a privilege escalation where a normal user can modify Orchestrate instructions for an admin-created chatbot due to improper access control on the endpoint /console/api/apps/{chatbot-id}/model-config. The CVE entry lists a CVSSv3 base scor...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

PT-2025-13693

Name of the Vulnerable Software and Affected Versions Tenda FH1202 version 1.2.0.14408 Description A critical issue has been found, affecting some unknown functionality of the file /default.cfg. The manipulation of the these argument leads to improper access controls. The attack may be launched...

Lunary 访问控制错误漏洞

Lunary is Lunary open source a production toolkit for LLM . Lunary has a security vulnerability that stems from improper privilege management, which can be exploited by an attacker to cause an administrator to bypass role controls to access billing information...

PT-2025-13689 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue was found in the Web Management Interface of the affected software, specifically in an unknown functionality of the file /goform/AdvSetWrlsafeset. This issue leads to improper...

PT-2025-13695 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue was found in the Web Management Interface of the affected software, specifically affecting an unknown part of the file /goform/qossetting. This issue leads to improper access...

PT-2025-12340

Name of the Vulnerable Software and Affected Versions D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description A vulnerability was found in the file /goform/formSetDomainFilter, affecting an unknown function. The manipulation leads to improper access controls. The attack c...

PT-2025-13697 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: A critical issue has been discovered, affecting the Web Management Interface component, specifically the /goform/SysToolChangePwd file. This leads to improper access controls, allowing for remote...

PT-2025-12339 · D Link · D-Link Dir-605L +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description: A problematic issue has been found, affecting some unknown processing of the file /goform/formAdvNetwork, leading to improper access controls. The attack can on...

PT-2025-12348

Name of the Vulnerable Software and Affected Versions Audi UTR Dashcam versions 2.0 through 2.88 Description A critical issue has been found in the Audi UTR Dashcam, affecting an unknown functionality of the Command API component. This leads to improper access controls, and the attack must be don...

PT-2025-13684

Name of the Vulnerable Software and Affected Versions Tenda FH1202 version 1.2.0.14408 Description A critical issue has been discovered, affecting an unknown function of the file /goform/AdvSetWrlmacfilter in the Web Management Interface component. This leads to improper access controls, allowing...

PT-2025-12345

Name of the Vulnerable Software and Affected Versions D-Link DIR-618 and DIR-605L versions 2.02/3.02 Description A vulnerability was found in the processing of the file /goform/formVirtualServ. This issue leads to improper access controls. The attack needs to be approached within the local networ...

PT-2025-12341

Name of the Vulnerable Software and Affected Versions D-Link DIR-618 versions 2.02/3.02 D-Link DIR-605L versions 2.02/3.02 Description A vulnerability has been found in the affected devices, classified as problematic. It affects an unknown functionality of the file /goform/formSetPassword, leadin...

CVE-2025-26475

Dell Secure Connect Gateway SCG 5.0 Appliance - SRS, versions 5.26, Enables Live-Restore setting which enhances security by keeping containers running during daemon restarts, reducing attack exposure, preventing accidental misconfigurations, and ensuring security controls remain active...

PT-2025-11690 · Dell · Dell Secure Connect Gateway

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG 5.0 Appliance - SRS version 5.26 Description: The issue concerns the Live-Restore setting, which is designed to enhance security by keeping containers running during daemon restarts. This setting reduces attack...

AIX : Multiple Vulnerabilities (IJ53929)

The version of AIX installed on the remote host is prior to APAR IJ53929. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ53929 advisory. - IBM AIX 7.2 and 7.3 nimsh service SSL/TLS protection mechanisms could allow a remote attacker to execute arbitrary commands due...