CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

A remote code execution RCE vulnerability exists in the '/installextension' endpoint of the parisneo/lollms-webui application, specifically within the @router.post"/installextension" route handler. The vulnerability arises due to improper handling of the name parameter in the...

CVE-2024-4320 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

A remote code execution RCE vulnerability exists in the '/installextension' endpoint of the parisneo/lollms-webui application, specifically within the @router.post"/installextension" route handler. The vulnerability arises due to improper handling of the name parameter in the...

CVE-2024-4320

CVE-2024-4320 describes a remote code execution via path traversal in parisneo/lollms (extensions builder). The Red Hat and related records credit a vulnerability in parisneo/lollms where ExtensionBuilder().build_extension() on the /mount_extension endpoint (and similarly described install_extens...

CVE-2023-34186

Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3...

CVE-2023-34186

CVE-2023-34186 affects the WordPress plugin Headless CMS (older:

CVE-2023-34186 WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability

Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3...

CVE-2023-34186 WordPress Headless CMS plugin <= 2.0.3 - Broken Authentication vulnerability

Missing Authorization vulnerability in Imran Sayed Headless CMS.This issue affects Headless CMS: from n/a through 2.0.3...

WordPress plugin Headless CMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-1522

CVE-2024-1522 affects the parisneo/lollms-webui project. The vulnerability is a CSRF in the /execute_code endpoint that fails to validate requests, allowing an attacker to craft a malicious page that submits commands to the victim's local lollms-webui instance and execute arbitrary OS commands. T...

openSUSE Security Advisory (SUSE-SU-2024:0847-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-22407

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for order...

Design/Logic Flaw

Shopware is an open headless commerce platform. In the Shopware CMS, the state handler for orders fails to sufficiently verify user authorizations for actions that modify the payment, delivery, and/or order status. Due to this inadequate implementation, users lacking 'write' permissions for order...

Design/Logic Flaw

Shopware is an open headless commerce platform. The implemented Flow Builder functionality in the Shopware application does not adequately validate the URL used when creating the “call webhook” action. This enables malicious users to perform web requests to internal hosts. This issue has been fix...

CVE-2024-22408

Shopware Flow Builder has a URL validation issue in the call webhook action that enables SSRF to internal hosts. Affected: Shopware open headless commerce platform (Flow Builder component). Impact: potential unauthorized web requests from authenticated users to internal destinations. Remediation:...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...

Mozilla: Heap buffer overflow affected <code>nsWindow::PickerOpen(void)</code> in headless mode

The Mozilla Foundation Security Advisory describes this flaw as: The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode...