CVE-2024-34313

An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint...

CVE-2024-34313

An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint...

CVE-2024-34313

Summary: CVE-2024-34313 affects VPL Jail System up to v4.0.2. A path traversal flaw in the jail server allows an attacker to craft requests to a public endpoint to write arbitrary files to the host filesystem, enabling potential privilege escalation (e.g., via overwriting /etc/ld.so.preload). The...

CVE-2024-38329

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this...

CVE-2024-5208

An uncontrolled resource consumption vulnerability exists in the upload-link endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service DOS by shutting down the server through sending invalid upload requests. Specifically, the server can be made to sh...

CVE-2024-5208 Uncontrolled Resource Consumption in mintplex-labs/anything-llm

An uncontrolled resource consumption vulnerability exists in the upload-link endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service DOS by shutting down the server through sending invalid upload requests. Specifically, the server can be made to sh...

CVE-2024-5208

The CVE concerns mintplex-labs/anything-llm. The vulnerable component is the upload-link endpoint, where an uncontrolled resource‑consumption (DoS) issue can be triggered by sending invalid upload requests. Specifically, an empty body with Content-Length: 0 or a body of arbitrary content (e.g., a...

Security Bulletin: Multiple Vulnerabilities have been identified in IBM Db2 shipped with IBM WebSphere Remote Server

Summary IBM Db2 is shipped with IBM WebSphere Remote Server. Information about security vulnerabilities affecting IBM Db2 have been published in a security bulletin CVE-2023-45853, CVE-2023-29267, CVE-2024-25710, CVE-2024-26308, CVE-2023-45178, CVE-2024-28762, CVE-2024-28757, CVE-2024-29025,...

The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 lies in the lack of access control mechanisms. This allows attackers to enhance their privileges and gain unauthorized access to protected information.

The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 relates to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges and gain unauthorized access to protected information by sending a specially crafted...

CVE-2024-34111

Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by a Server-Side Request Forgery SSRF vulnerability that could lead to arbitrary file system read. A low-privilege authenticated attacker can force the application to make arbitrary requests via injection of...

CVE-2024-34111

CVE-2024-34111 is a Server-Side Request Forgery (SSRF) affecting Adobe Commerce/Magento Open Source versions up to 2.4.7 and earlier (e.g., 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier). The issue allows a low-privilege, authenticated attacker to cause arbitrary file system reads by injecting ...

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...

CVE-2024-36103

OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...

Schneider Electric SAGE RTUs Path Traversal Vulnerability

The Schneider Electric SAGE RTUs is a high-performance device for industrial automation and remote monitoring from Schneider Electric France. A path traversal vulnerability exists in the Schneider Electric SAGE RTUs, which originates from allowing an authenticated user to access the device's web...

WEB VIDEO PLATFORM Security Vulnerabilities

WEB VIDEO PLATFORM is a WVP-PRO open source out-of-the-box web video platform implemented based on the GB28181-2016 standard. A security vulnerability exists in WEB VIDEO PLATFORM GB28181 Pro version 2.0, which stems from an access control issue that allows an authenticated attacker to elevate...

CVE-2024-37665

An access control issue in Wvp GB28181 Pro 2.0 allows authenticated attackers to escalate privileges to Administrator via a crafted POST request...

GitLab CE/EE Security Vulnerabilities

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of GitLab, Inc. GitLab Enterprise Edition is a content management system. GitLab Enterprise Edition is a content management system. A security vulnerability exists in GitLab CE/EE that stems from an attacker being able...

Schneider Electric SAGE RTUs Security Vulnerability

Schneider Electric SAGE RTUs is a high-performance device for industrial automation and remote monitoring from Schneider Electric France. A security vulnerability exists in the Schneider Electric SAGE RTUs that stems from the presence of an unchecked return value, which could result in a denial o...

Exploit for Server-Side Request Forgery in Cisco Finesse

Description A vulnerability in the web-based management inte...

Arbitrary file deletion in litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...