157 matches found
PT-2024-17856 · Unknown · Running-Elephant Datart
Name of the Vulnerable Software and Affected Versions: running-elephant Datart version 1.0.0-rc3 Description: A critical issue affects the extractModel function of the File Upload component, specifically in the /import file. The manipulation of the file argument leads to deserialization. This iss...
WordPress plugin Hunk Companion 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Hertzbeat 安全漏洞
Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat prior to version 1.6.0 that stems from an insecure deserialization issue in the /api/monitors/import location that could lead to remote code execution...
Authorization Bypass
io.github.microcks, microcks is vulnerable to Authorization Bypass. The vulnerability is caused due to a missing validation around POST /api/import and POST /api/export endpoints. This leads to Authorization bypass...
CVE-2024-3279: Missing Authentication for Critical Function
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
CVE-2024-3279 Improper Access Control in mintplex-labs/anything-llm
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...
PT-2023-20682 · Directus · Directus
Name of the Vulnerable Software and Affected Versions: Directus versions prior to 9.23.0 Description: Directus is a real-time API and App dashboard for managing SQL database content. It is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server via a POST...
PT-2022-22670 · Robustel · Robustel R1510
Name of the Vulnerable Software and Affected Versions: Robustel R1510 versions 3.1.16 through 3.3.0 Description: A denial of service issue exists in the web server hashFirst functionality. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of reques...
PT-2022-22668 · Robustel · Robustel R1510
Name of the Vulnerable Software and Affected Versions: Robustel R1510 versions 3.1.16 through 3.3.0 Description: A denial of service issue exists in the web server hashFirst functionality. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of reques...
CVE-2022-32258: Obsolete Feature in UI
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The affected application contains an older feature that allows to import device configurations via a specific endpoint. An attacker could use this vulnerability for information disclosure...
PT-2021-22718 · Gitlab · Gitlab Ce/Ee +1
Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 and later Description: The issue allows an attacker to bypass the setting to disable Bitbucket Server import by making a crafted API call. This affects instances of GitLab CE/EE where this setting is enabled...
Apache Airflow Licensing Issue Vulnerability (CNVD-2022-62076)
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...
PYSEC-2021-326
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
PYSEC-2021-326
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
CVE-2021-38540: Improper Privilege Management
The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...
Apache Airflow 访问控制错误漏洞
Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored. Apache Airflow is vulnerable to an authorization issue that stems from a lack of authorization protection on the product's...