987 matches found
org.apache.poi:poi-examples (3.11-beta1), org.apache.poi:poi-excelant (3.11-beta1) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta1)
org.apache.poi:poi-ooxml MAVEN version 3.11-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.11-beta1 - org.apache.poi:poi-excelant 3.11-beta1 Source cves: CVE-2025-3167...
Exploit for CVE-2025-30208
Disclaimer: The vulnerabilities described in this document, a...
Directory Traversal
agentscope is vulnerable to Directory Traversal. The vulnerability is due to improper validation of user-supplied file paths in the /read-examples endpoint, allowing attackers to traverse directories and access arbitrary JSON files...
com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +23 more potentially affected by CVE-2025-2559 via org.keycloak:keycloak-services (14.0.0)
org.keycloak:keycloak-services MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8,...
External Control of File Name or Path
Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to External Control of File Name or Path through the /read-examples endpoint. An attacker can read any local JSON file, containing API keys by sending a crafted POST...
ai.h2o:sparkling-water-api-generation_2.11 (>=3.34.0.3-1-2.2, <=3.46.0.6-1-2.4), ai.h2o:sparkling-water-api-generation_2.12 (>=3.34.0.3-1-3.0, <=3.46.0.6-1-3.5) +9 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.34.0.1, <=3.46.0.11)
ai.h2o:h2o-ext-xgboost MAVEN version =3.34.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.1-1-2.2, =3.34.0.1-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =2.0.0, =3.0.0 Source cves: CVE-2024-10572 Source advisory:...
ai.h2o:sparkling-water-api-generation_2.11 (>=3.34.0.3-1-2.2, <=3.46.0.1-1-2.4), ai.h2o:sparkling-water-api-generation_2.12 (>=3.34.0.3-1-3.0, <=3.46.0.1-1-3.5) +9 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.34.0.1, <=3.46.0.1)
ai.h2o:h2o-ext-xgboost MAVEN version =3.34.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.1-1-2.2, =3.34.0.1-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =2.0.0, =2.1.1 Source cves: CVE-2024-10572 Source advisory:...
ai.h2o:sparkling-water-api-generation_2.11 (>=3.34.0.3-1-2.2, <=3.46.0.1-1-2.4), ai.h2o:sparkling-water-api-generation_2.12 (>=3.34.0.3-1-3.0, <=3.46.0.1-1-3.5) +9 more potentially affected by CVE-2024-10572 via ai.h2o:h2o-ext-xgboost (>=3.34.0.1, <=3.46.0.1)
ai.h2o:h2o-ext-xgboost MAVEN version =3.34.0.1, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.1-1-2.2, =3.34.0.1-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =3.34.0.3-1-2.2, =3.34.0.3-1-3.0, =2.0.0, =2.1.1 Source cves: CVE-2024-10572 Source advisory: GHSA-WJPV-64V2-2QPQ...
CVE-2024-8524
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
PYSEC-2025-83
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
PYSEC-2025-83
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
CVE-2024-8524
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
CVE-2024-8524: Improper Limitation of a Pathname to a Restricted Directory
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
AgentScope 安全漏洞
AgentScope is a ModelScope open source application. Build LLM-based multi-intelligence applications more simply. A security vulnerability exists in AgentScope version 0.0.4, which stems from the presence of directory traversal in the /read-examples endpoint, which allows an attacker to read...
PT-2025-12234
Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.4 Description A directory traversal issue exists, allowing an attacker to read any local JSON file by sending a crafted POST request to the "/read-examples" endpoint. This enables the attacker to access...
Penetration Testing Steps and Tools
This whitepaper goes over reconnaissance of a target, various types of attacks leveraged during penetration testing, and provides examples of the commands used in the process...
Malicious code in paymaster-bundler-examples (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 976dfeb2cefe9c3b2fc6b0da31c62937a4bdbaabc387c7f16ce1a86e2b872e7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2186 Malicious code in paymaster-bundler-examples (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 976dfeb2cefe9c3b2fc6b0da31c62937a4bdbaabc387c7f16ce1a86e2b872e7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2040 Malicious code in grpc-examples (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b24550ca95d1b3f32e64730ef0909c4080788c96e910d97b45b9e598e4b9c222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...