15722 matches found
CVE-2024-4328
A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...
CVE-2024-4328
The CVE-2024-4328 issue is a CSRF vulnerability in the parisneo/lollms-webui v9.6, caused by using a GET request in clear_personality_files_list that lacks CSRF protection. This allows an attacker to coerce authenticated users into performing actions (e.g., deleting files) without consent. Affect...
CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui
A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...
CVE-2024-4328 CSRF in clear_personality_files_list in parisneo/lollms-webui
A Cross-Site Request Forgery CSRF vulnerability exists in the clearpersonalityfileslist function of the parisneo/lollms-webui v9.6. The vulnerability arises from the use of a GET request to clear personality files list, which lacks proper CSRF protection. This flaw allows attackers to trick users...
LoLLMs Cross-Site Request Forgery Vulnerability
LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version v9.6, which stems from the use of a GET request to clear a list of personalized files that lacks proper cross-site request...
CVE-2024-37388
An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of lxml before v4.9.1 allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...
PYSEC-2024-76
An XML External Entity XXE vulnerability in the ebookmeta.getmetadata function of ebookmeta before v1.2.8 allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...
PT-2024-27172 · Ebookmeta · Ebookmeta
Name of the Vulnerable Software and Affected Versions: ebookmeta versions prior to 1.2.8 Description: An XML External Entity XXE vulnerability in the ebookmeta.get metadata function allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input...
ebookmeta Security Vulnerabilities
ebookmeta is a Python library for managing metadata for epub2, epub3, and fb2 files by Dmitrii Personal Developer. A security vulnerability exists in ebookmeta versions prior to v1.2.8, which stems from an XML External Entity vulnerability in the ebookmeta.getmetadata function that could allow an...
PT-2024-27514
Name of the Vulnerable Software and Affected Versions lxml versions prior to 4.9.1 Description An XML External Entity XXE vulnerability in the ebookmeta.get metadata function allows attackers to access sensitive information or cause a Denial of Service DoS via crafted XML input. Recommendations F...
Server-Side Request Forgery in langchain-community.retrievers.web_research.WebResearchRetriever
A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component in langchain-community langchain-community.retrievers.webresearch.WebResearchRetriever. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet...
CVE-2024-5133
In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the GET /v1/users/me/org endpoint, which...
CVE-2024-5248 Improper Access Control in lunary-ai/lunary
In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the GET /v1/users/me/org endpoint. The platform's role definitions restrict the Prompt Editor role to prompt management and project viewing/listing capabilities, explicitly...
CVE-2024-5248 Improper Access Control in lunary-ai/lunary
In lunary-ai/lunary version 1.2.5, an improper access control vulnerability exists due to a missing permission check in the GET /v1/users/me/org endpoint. The platform's role definitions restrict the Prompt Editor role to prompt management and project viewing/listing capabilities, explicitly...
CVE-2024-3095 SSRF in Langchain Web Research Retriever in langchain-ai/langchain
A Server-Side Request Forgery SSRF vulnerability exists in the Web Research Retriever component of langchain-ai/langchain version 0.1.5. The vulnerability arises because the Web Research Retriever does not restrict requests to remote internet addresses, allowing it to reach local addresses. This...
CVE-2024-5188
The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'getmanualcalendarevents' function in all versions up to, and including, 5.9.22 due to insufficient input sanitization and...
CVE-2024-3049
A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcrymdgetalgodlen, it may allow an invalid HMAC to be accepted by the Booth server...
CVE-2024-36837
SQL Injection vulnerability in CRMEB v.5.2.2 allows a remote attacker to obtain sensitive information via the getProductList function in the ProductController.php file...
Authentication Bypass
github.com/casgate/casgate is vulnerable to Authentication Bypass. The vulnerability is due to improper authorization checks using the id parameter in GET requests, which allows attackers to bypass authentication and access sensitive information remotely without authorization...
