JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An information disclosure vulnerability exists in...

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel...

Browsershot Local File Inclusion

Versions of the package spatie/browsershot before 5.0.1 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method. An attacker can exploit this vulnerability by using leading whitespace %20 before the file:// protocol, resulting in Local File Inclusion,...

CVE-2024-21544

CVE-2024-21544 affects spatie/browsershot <= 5.0.1 due to improper URL validation in setUrl; leading whitespace before file:// can cause Local File Inclusion. CVE-2024-21549 (browsershot

UBUNTU-CVE-2024-11053

When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but...

zhmc-ansible-modules 安全漏洞

zhmc-ansible-modules is an Ansible collection for IBM Z HMC open sourced by zhmcclient. A security vulnerability exists in zhmc-ansible-modules, which stems from the fact that under certain circumstances, ibm.ibmzhmc writes password-like attributes in plaintext to its log files and to the output...

CVE-2022-43933

An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. The Logged information may include usernames and passwords...

Unauthorized File Access

@oakserver/oak is vulnerable to Unauthorized File Access. The vulnerability is due to inadequate sanitization of URL-encoded characters in the Context.send API, allows attackers to encode / as %2F, bypassing the restriction on hidden files and potentially exposing sensitive data...

CVE-2020-11918

An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including passwords, can be found in cleartext in the backup file. An attacker capable of accessing the web interface can create the backup file...

USN-6882-2 cinder regression

USN-6882-1 fixed vulnerabilities in Cinder. The update caused a regression in certain environments due to incorrect privilege handling. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Martin Kaesberger discovered that Cinder incorrectly handled QCOW2...

Ollama < 0.1.46 Multiple Vulnerabilities

The version of Ollama installed on the remote host is prior to 0.1.46. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF...

The vulnerability of the log management function of the Cisco Nexus Dashboard Fabric Controller (NDFC) and the Cisco Nexus Dashboard Orchestrator (formerly Cisco Multi-Site Orchestrator), related to the disclosure of information through log files, allows attackers to access protected information.

The vulnerability of the log management function of the Cisco Nexus Dashboard Fabric Controller NDFC, as well as the network management and policy management functions of the Cisco Nexus Dashboard Orchestrator formerly Cisco Multi-Site Orchestrator, relates to the disclosure of information throug...

CVE-2024-39722

An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route...

CVE-2024-39722

The Ollama large language model management system (versions before 0.1.46 ) is vulnerable to a path traversal issue in the api/push route. This flaw allows an attacker to determine which files exist on the server, specifically enabling model existence disclosure where a user can identify whether ...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

CVE-2024-24919POC It's Proof of Concept on CVE-2024-24919-POC...

CVE-2024-10100 Path Traversal in binary-husky/gpt_academic

A path traversal vulnerability exists in binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host system, including sensitive files such as...

Directory Traversal

Gradio is vulnerable to a Directory Traversal. The vulnerability is due to improper data validation in several Gradio components, allowing attackers to bypass input constraints and leak arbitrary files through the post-processing step. This could expose sensitive files to unauthorized users,...

VulnCheck KEV: CVE-2019-25213

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive file...

CVE-2024-44807

A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition before 2.25.1 allows remote attackers to obtain sensitive information by exposing a list of the uploaded files...

PYSEC-2024-217

Gradio is an open-source Python package designed for quick prototyping. This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected...