CVE-2024-1600 Local File Inclusion in parisneo/lollms-webui

A Local File Inclusion LFI vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences ../../ followed by the desired system file path, URL...

CVE-2024-1600 Local File Inclusion in parisneo/lollms-webui

A Local File Inclusion LFI vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences ../../ followed by the desired system file path, URL...

CVE-2024-1600 Local File Inclusion in parisneo/lollms-webui

A Local File Inclusion LFI vulnerability exists in the parisneo/lollms-webui application, specifically within the /personalities route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences ../../ followed by the desired system file path, URL...

CVE-2024-1728 Local File Inclusion in gradio-app/gradio

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...

CVE-2024-1728

Gradio has a local file inclusion/path traversal vulnerability in the UploadButton component (affecting Gradio prior to 4.19.2). Attackers could read arbitrary files on the host (e.g., private keys) by manipulating the file path in requests to /queue/join, with potential remote code execution ris...

CVE-2024-1728 Local File Inclusion in gradio-app/gradio

gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in t...

Path Traversal

org.apache.zeppelin: zeppelin-server is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user-supplied input, allowing attackers to use relative paths e.g., ".." to access files on the server's filesystem that the server account has permissions to access...

PT-2024-32742

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description A vulnerability in the Linux kernel has been resolved, specifically in the f2fs filesystem. The issue arises from the f2fs setting the SB RDONLY flag in an internal function rather than through...

Apache Zeppelin Path Traversal vulnerability

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators e.g .., attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin from 0.9.0 before 0.11.0. Users are recommended to upgrade t...

CVE-2024-31860

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicatorsE.g .., attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade t...

CVE-2024-31860 Apache Zeppelin: Path traversal vulnerability

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicatorsE.g .., attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade t...

CVE-2024-31860

CVE-2024-31860 affects Apache Zeppelin through an improper input validation flaw that enables path traversal via relative paths (e.g., ..). The issue allows an attacker to view files on the server filesystem that the Zeppelin server account can access. Affected range: Zeppelin 0.9.0 up to before ...

SUSE SLES15 Security Update : buildah (SUSE-SU-2024:1144-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1144-1 advisory. - CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. bsc1221677 - Update to version 1.34.1 for compatibility wi...

SUSE SLES15 Security Update : buildah (SUSE-SU-2024:1145-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1145-1 advisory. - CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. bsc1221677 - Update to version 1.34.1 for compatibility wi...

SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2024:1143-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:1143-1 advisory. - CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. bsc1221677 - Update to version 1.34.1 for...

PT-2024-26798

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.9 Description The issue is related to the btrfs file system in the Linux kernel. It was discovered that the kernel did not properly set the WRITTEN flag on all metadata blocks, which could lead to corruption ...

nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization

A flaw was found in Node.js. Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwritten with user-defined implementations, leading to a filesystem permission model bypass through a path traversal attack...

nodejs: improper handling of wildcards in --allow-fs-read and --allow-fs-write

A flaw was found in the Node.js Permission Model, where it is not clarified in the documentation that wildcards should only be used as the last character of a file path. For example: --allow-fs-read=/home/node/.ssh/.pub will ignore pub and give access to everything after .ssh/...

nodejs: multiple permission model bypasses due to improper path traversal sequence sanitization

A flaw was found in Node.js. Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwritten with user-defined implementations, leading to a filesystem permission model bypass through a path traversal attack...

Huawei EulerOS: Security Advisory for docker-runc (EulerOS-SA-2024-1483)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...