CVE-2024-0798 Privilege Escalation in mintplex-labs/anything-llm

A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this...

CVE-2024-0798 Privilege Escalation in mintplex-labs/anything-llm

A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this...

CVE-2024-0798 Privilege Escalation in mintplex-labs/anything-llm

A privilege escalation vulnerability exists in mintplex-labs/anything-llm, allowing users with 'default' role to delete documents uploaded by 'admin'. Despite the intended restriction that prevents 'default' role users from deleting admin-uploaded documents, an attacker can exploit this...

The vulnerability of the tcg2measuregpttable() function in the Tianocore EDK2 library, caused by buffer overflows, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcg2measuregpttable function in the Tianocore EDK2 library is caused by buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the tcg2measurepeimage() function in the Tianocore EDK2 library, caused by buffer overflows, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcg2measurepeimage function in the Tianocore EDK2 library is caused by buffer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

PT-2024-5545 · D Link · D-Link Dir-882-Us +9

Name of the Vulnerable Software and Affected Versions: D-Link DIR-1960-US, DIR-2640-US, DIR-2660-US, DIR-3040-US, DIR-3060-US, DIR-867-US, DIR-878, DIR-882-US, DIR-882/RE, DIR-882-CA and DIR-882-US/RE affected versions not specified Description: The issue exists due to the lack of measures to...

The vulnerability of the LdapSettings.get_ldap_info component of the Dell Data Protection Search system allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the LdapSettings.getldapinfo component in the Dell Data Protection Search system exposes it to data leaks from various sources. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Vulnerabilities fixed in IBM WebSphere Application Server

IBM has fixed vulnerabilities in WebSphere. The vulnerabilities are located in the Java component of WebSphere and allow a malicious party to carry out attacks that could lead to loss of data integrity and confidentiality. IBM did not release any other detailed information. A more precise risk...

The vulnerability of the SAP Application Interface Framework, a software tool for developing and managing application interfaces, arises from improper code generation. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of data.

The vulnerability of the SAP Application Interface Framework, a software tool for developing and managing application interfaces, is related to improper code generation. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of data...

CVE-2024-20925

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JavaFX. Supported versions that are affected are Oracle Java SE: 8u391; Oracle GraalVM Enterprise Edition: 20.3.12 and 21.3.8. Difficult to exploit vulnerability allows unauthenticated...

CVE-2024-20913

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Platform Security. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Code injection

Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Knowledge...

K000138643: OpenSSH vulnerability CVE-2023-51767

Security Advisory Description OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks for authentication bypass because the integer value of authenticated in mmanswerauthpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat...

Security Bulletin: IBM Copy Services manager is affected by IBM SDK, Java Technology Edition Quarterly CPU - Oct 2023 - Includes Oracle October 2023 CPU plus CVE-2023-5676

Summary IBM Copy Services Manager is affected by All applicable Java SE CVEs published by Oracle as part of their October 2023 Critical Patch Update plus CVE-2023-5676. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

K000138628: python-pip vulnerabilities CVE-2021-3572 and CVE-2023-5752

Security Advisory Description CVE-2021-3572 A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity...

The vulnerability of the twisted.web network framework’s component, which allows a hacker to compromise the integrity of the protected information.

The vulnerability of the twisted.web network framework’s component is related to inconsistent interpretation of HTTP requests. Exploiting this vulnerability allows a remote attacker to compromise the integrity of protected information through multiple HTTP requests...

PT-2024-19958 · F5 · Big-Ip

Name of the Vulnerable Software and Affected Versions: BIG-IP affected versions not specified Description: An SQL injection issue exists in an undisclosed page of the BIG-IP Configuration utility. The exact nature of the issue and its potential impact are not fully detailed, but it suggests a...

The vulnerability of the XWiki Admin Tools application on the XWiki Platform. XWiki is a platform for creating collaborative web applications. This vulnerability allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the XWiki Admin Tools application in the XWiki platform involves insufficient verification of the authenticity of executed queries. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the confidentiality, integrity, and accessibility...

The vulnerability of microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA flow gas analyzers is related to deficiencies in authentication procedures. This allows attackers to compromise data integrity and cause service failures.

The vulnerability of the microprogrammed software in Emerson Rosemoun GC1500XA, GC700XA, and GC370XA gas analyzers is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to compromise data integrity and cause service failures...

The vulnerability in the app/plug/controller/giftcontroller.php script of the Zhicms CMS system allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the app/plug/controller/giftcontroller.php script of the Zhicms CMS system is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected informatio...