CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

Mlflow 路径遍历漏洞

Mlflow is an open source platform for the machine learning lifecycle. Mlflow suffers from a path traversal vulnerability that stems from improper handling of URL parameters. An attacker can use this vulnerability to gain access to a file or directory...

PT-2024-26659

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain affected versions not specified Description langchain-ai/langchain is susceptible to a path traversal issue stemming from insufficient restriction of pathnames within its LocalFileStore functionality. This allows attacke...

LangChain 路径遍历漏洞

LangChain is built as an application using LLM through composability. LangChain suffers from a path traversal vulnerability that stems from vulnerability to a path traversal attack, which can be exploited by an attacker to read or write a file anywhere on the filesystem, potentially leading to...

PT-2024-18129

Name of the Vulnerable Software and Affected Versions mlflow/mlflow affected versions not specified Description A path traversal issue exists due to improper validation of the source parameter in the create model version function. This allows attackers to bypass checks by the validate non local...

AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an input validation error vulnerability that stems from a failure to properly clean user-supplied input, allowing an attacker to read and delete arbitrary files on the server...

iTop 安全漏洞

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop versions 2.7.10, 3.0.4, 3.1.1, and 3.2.0, which stems from the ability to retrieve files in the env-production folder, even though they should have restricted access...

PT-2024-18737 · Zenml · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml affected versions not specified Description: A directory traversal issue exists, specifically within the "/api/v1/steps" endpoint. Attackers can exploit this by manipulating the logs URI path to fetch arbitrary file content,...

PT-2024-18157

Name of the Vulnerable Software and Affected Versions mlflow/mlflow affected versions not specified Description A path traversal issue exists in the handling of the artifact location parameter when creating an experiment. Attackers can exploit this by using a fragment component in the artifact...

CVE-2024-3707

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to enumerate all files in the web tree by accessing a php file...

NiceGUI 安全漏洞

NiceGUI is an easy-to-use, Python-based UI framework open-sourced by NiceGUI. A security vulnerability exists in NiceGUI versions prior to 1.4.21. An attacker exploiting this vulnerability can access any file on the backend file system...

Real-time File Access Monitoring (FAM) with Qualys FIM

What is File Access Monitoring FAM? FAM is a security practice that involves tracking and logging access to sensitive files. FAM should be included with any File Integrity Monitoring FIM solution to trigger alerts when critical host files not intended for regular use are accessed. Importance of F...

PYSEC-2024-316

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the config.json file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys...

Multiple vulnerabilities in a-blog cms

Overview a-blog cms provided by appleple inc. contains multiple vulnerabilities listed below. Stored cross-site scripting vulnerability in Entry editing pages CWE-79 - CVE-2024-30419 Server-side request forgery CWE-918 - CVE-2024-30420 Directory traversal CWE-22 - CVE-2024-31394 Stored cross-site...

PT-2024-26914 · Sourcecodester · Sourcecodester Warehouse Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Warehouse Management System version 1.0 Description: A problematic issue was found in the SourceCodester Warehouse Management System, affecting some unknown functionality of the file supplier.php. The manipulation of the...

PT-2024-18103 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an...

PT-2024-23297 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is related to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this by...

a-blog cms 安全漏洞

a-blog cms is a Japanese content management system CMS. A security vulnerability exists in a-blog cms versions before Ver.3.1.12, before Ver.3.0.32, before Ver.2.11.61, and before Ver.2.10.53, which originates from a vulnerability that could allow an attacker to log in to the product and obtain...

PT-2024-7548 · Microsoft · Azure Monitor Agent

Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent affected versions not specified Description: The issue is related to an elevation of privilege vulnerability in the Azure Monitor Agent, which is used for data collection from virtual machines VM and physical servers. The...

PT-2024-2889 · Microsoft · Azure Monitor Agent

Name of the Vulnerable Software and Affected Versions: Azure Monitor Agent affected versions not specified Description: The issue is related to an incorrect reference count before accessing a file, which can be exploited to elevate privileges. Recommendations: At the moment, there is no informati...