CVE-2024-32862 exacqVision CORS

Under certain circumstances the ExacqVision Web Services does not provide sufficient protection from untrusted domains...

Microsoft Edge Spear Phishing

The vulnerability of Microsoft Edge relates to insufficient protection of the web page structure. Exploiting this vulnerability allows a remote attacker to perform spear-phishing attacks...

CVE-2024-32861

Under certain circumstances the impacted Software House C•CURE 9000 installer will utilize unnecessarily wide permissions...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

PT-2024-36727 · Mudler · Localai

Name of the Vulnerable Software and Affected Versions: mudler/LocalAI versions up to and including 2.15.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists, allowing attackers to trick victims into deleting installed models by crafting a malicious HTML page. This can cause the...

Track Viewer Client Privilege Escalation

The vulnerability of the Track Viewer Client component of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager system is related to insufficient protection of registration data. Exploiting this vulnerability could allow attackers to increase...

Adobe Experience Manager Code Execution

The vulnerability of the Adobe Experience Manager content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2023-41926 Insufficiently protected credentials in Kiloview P1/P2 devices

The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials...

CVE-2024-38285

Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools...

CVE-2024-38285

CVE-2024-38285 affects Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) and related firmware versions up to 3.1.171.9. The vulnerability is insufficient protection of logs that store credentials, which can be decoded with open source tools, exposing sensitive credentials. Impact metr...

CVE-2024-4326

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the /applysettings and /executecode endpoints. Attackers can bypass protections by setting the host to localhost, enabling code...

CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the /applysettings and /executecode endpoints. Attackers can bypass protections by setting the host to localhost, enabling code...

CVE-2024-27109

Insufficiently protected credentials in GE HealthCare EchoPAC products...

Blog2Social Plugin Unauthorized Access

The vulnerability of the Blog2Social plugin of the WordPress content management system is related to insufficient protection of administrative data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2024-1646

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...

CVE-2024-1646

CVE-2024-1646 affects parisneo/lollms-webui. The vulnerability is an authentication bypass caused by insufficient protection over sensitive endpoints; the app only checks that the host parameter is not '0.0.0.0', which is inadequate when bound to a specific interface. This allows unauthorized acc...

CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...

CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized...