1056 matches found
CVE-2025-20128
A vulnerability in the Object Linking and Embedding 2 OLE2 decryption routine of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an integer underflow in a bounds check that allows for a heap buff...
GHSA-FCR8-4R9F-R66M nbgrader's `frame-ancestors: self` grants all users access to formgrader
Impact Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content by sending malicious links to users with access to formgrader, at least when using the default JupyterHub configuration of enablesubdomains = False. 1915 disables a protection which would...
CVE-2025-21298
Windows OLE Remote Code Execution Vulnerability...
Microsoft OLE 资源管理错误漏洞
Microsoft OLE is an object-oriented technology from Microsoft Corporation USA. A resource management error vulnerability exists in Microsoft OLE. An attacker exploiting this vulnerability could remotely execute code. The following products and versions are affected:Windows Server 2019 Server Core...
January 7, 2025, update for PowerPoint 2016 (KB5002632)
None None...
PT-2025-39414
Name of the Vulnerable Software and Affected Versions TensorFlow version 2.18.0 Description TensorFlow version 2.18.0 exhibits a behavior where it outputs random results during the compilation of the Embedding component. This can lead to unpredictable application behavior. Recommendations At the...
AI Under the Microscope—What’s Changed in the OWASP Top 10 for LLMs 2025
As AI continues to evolve, so do the threats and vulnerabilities that surround Large Language Models LLMs. The OWASP Top 10 for LLM Applications 2025 introduces critical updates that reflect the rapid changes in how these models are applied in real-world scenarios. While the list includes...
Decidim 跨站脚本漏洞
Decidim is an open source participatory democracy framework from Decidim, written in Ruby on Rails. A cross-site scripting vulnerability exists in Decidim versions 0.28.0, 0.28.1, and 0.28.2, which stems from a potential cross-site scripting attack on meeting embedding functionality used in onlin...
Information Exposure
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure due to the embedding model update feature under admin settings. An attacker can expose sensitive information by observing error messages that vary based on the file's existence and...
CVE-2024-7038
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2024-7038
An information disclosure vulnerability exists in open-webui version 0.3.8. The vulnerability is related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different error messages based on the existenc...
CVE-2024-7038
This CVE entry is rejected/not used and does not represent an active vulnerability.
PT-2024-38040
Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description An information disclosure issue exists related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different err...
CVE-2024-45291
PHPSpreadsheet (PHPSpreadsheet) contains a path traversal/SRV (Server-Side Request Forgery) vulnerability in the HTML writer when embedImages is enabled. An XLSX can link images from arbitrary paths; output data: URLs may include local files and, with wrappers like expect://, enable remote reques...
CVE-2024-45291 Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with $writer-setEmbedImagestrue; those files will be included in th...
PhpSpreadsheet allows absolute path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled
Summary It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with $writer-setEmbedImagestrue; those files will be included in the output as data: URLs, regardless of the file's type. Also URLs can be...
Absolute Path Traversal
Overview Affected versions of this package are vulnerable to Absolute Path Traversal via the HTML writer process when embedding images. An attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests by constructing an XLSX file that links images from arbitrary paths or...
PT-2024-31544
Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 1.29.2 PHPSpreadsheet versions prior to 2.1.1 PHPSpreadsheet versions prior to 2.3.0 Description The issue allows an attacker to construct an XLSX file that links images from arbitrary paths. When embedding...
The vulnerability of the OLE DB driver for SQL Server on Windows operating systems arises from insufficient validation of input data, allowing attackers to exploit their privileges.
The vulnerability of the OLE DB driver for SQL Server on Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...