CVE-2024-4888 Arbitrary File Deletion in BerriAI/litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

CVE-2024-4888

BerriAI’s litellm (latest version) is affected by CVE-2024-4888 due to improper input validation on the /audio/transcriptions endpoint. The code uses os.remove(file.filename) to delete a file, allowing an attacker to delete arbitrary server files (e.g., SSH keys, SQLite databases, configuration f...

CVE-2024-2362 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

CVE-2024-2362 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

WordPress Strategery Migrations plugin <= 1.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin Strategery Migrations versions = 1.0...

WordPress Upunzipper plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin Upunzipper versions = 1.0.0...

WordPress SC filechecker plugin <= 0.6 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by YCInfosec Patchstack Alliance in WordPress Plugin SC filechecker versions = 0.6...

PT-2024-33255

Name of the Vulnerable Software and Affected Versions BerriAI's litellm version latest Description The issue arises from improper input validation on the "/audio/transcriptions" endpoint, allowing an attacker to send a specially crafted request that includes a file path to the server. This result...

WordPress Upunzipper Plugin <= 1.0.0 is vulnerable to Arbitrary File Deletion

Software Upunzipper Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-35744 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 20a11d86aa33 Credits YCInfosec Required privilege...

DedeCMS V5.7 SP2 Multiple Vulnerabilities (Mar/Apr/May/Jul 2024)

DedeCMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dedecms:dedecms"; if description...

WordPress Startklar Elementor Addons Plugin <= 1.7.15 is vulnerable to Arbitrary File Deletion

Software Startklar Elementor Addons Type Plugin Vulnerable versions = 1.7.15 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2024-5153 Patch priority High CVSS severity High 9.1 Developer Claim ownership PSID ac59d6e1fb44 Credits stealthcopter...

WordPress SC filechecker Plugin <= 0.6 is vulnerable to Arbitrary File Deletion

Software SC filechecker Type Plugin Vulnerable versions = 0.6 Fixed in N/A OWASP Top 10 A6: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2024-35743 Patch priority Low CVSS severity Low 8.6 Developer Claim ownership PSID 308e99f1ec04 Credits YCInfosec Required privilege...

PT-2024-19975 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version 9.3 Description: A path traversal vulnerability exists due to improper validation of file paths between Windows and Linux environments, allowing an attacker to delete any file on the system. The issue arises from...

LiteLLM Input Validation Error Vulnerability

LiteLLM is an open source application from Berri AI. All LLM APIs can be called using the OpenAI format. LiteLLM suffers from an input validation error vulnerability that stems from an improper input validation issue with the /audio/transcriptions API, resulting in vulnerability to arbitrary file...

GO-2024-2741 Owncast Path Traversal vulnerability in github.com/owncast/owncast

Owncast Path Traversal vulnerability in github.com/owncast/owncast...

The vulnerability of the single-input module in the LogPoint SAML Authentication application, related to improper external management of file names or paths, allows a malicious actor to delete any file and cause authentication failures when entering the system.

The vulnerability of the single-input module in the LogPoint SAML Authentication application is related to incorrect external management of file names or paths. Exploiting this vulnerability could allow a malicious actor to delete any desired file and cause authentication failures when logging in...

WordPress Checkout Field Editor for WooCommerce (Pro) plugin <= 3.6.2 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Checkout Field Editor for WooCommerce Pro versions = 3.6.2...

WordPress Checkout Field Editor for WooCommerce (Pro) Plugin <= 3.6.2 is vulnerable to Arbitrary File Deletion

Software Checkout Field Editor for WooCommerce Pro Type Plugin Vulnerable versions = 3.6.2 Fixed in 3.6.3 OWASP Top 10 A3: Injection Classification Arbitrary File Deletion CVE CVE-2024-35658 Patch priority High CVSS severity High 8.6 Developer Claim ownership PSID 9d1a439eb128 Credits Dave Jong...

Unsafe Reflection in base Component class in yiisoft/yii2

Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...

GHSA-CJCC-P67M-7QXM Unsafe Reflection in base Component class in yiisoft/yii2

Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...