CVE-2024-12779 SSRF in infiniflow/ragflow

A Server-Side Request Forgery SSRF vulnerability exists in infiniflow/ragflow version 0.12.0. The vulnerability is present in the POST /v1/llm/addllm and POST /v1/conversation/tts endpoints. Attackers can specify an arbitrary URL as the apibase when adding an OPENAITTS model, and subsequently...

CVE-2024-3149

A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...

CVE-2024-12365

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the isw3tcadminpage function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain...

GHSA-342Q-2MC2-5GMP @jmondi/url-to-png enables capture screenshot of localhost web services (unauthenticated pages)

Summary The maintainer been contemplating whether FTP or other protocols could serve as useful functionalities, but there may not be a practical reason for it since we are utilizing headless Chrome to capture screenshots. The argument is based on the assumption that this package can function as a...

CVE-2024-3149 SSRF in mintplex-labs/anything-llm

A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...

CVE-2024-3149 SSRF in mintplex-labs/anything-llm

A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...

VulnCheck KEV: CVE-2023-49785

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using...

CVE-2023-20237

A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise inaccessible. This vulnerability is due to insufficient restrictions on internally accessible http proxies. An attacker could exploit this...

PT-2023-4616 · Cisco · Cisco Intersight Virtual Appliance

Name of the Vulnerable Software and Affected Versions: Cisco Intersight Virtual Appliance affected versions not specified Description: A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services that are otherwise...

Cisco Intersight 命令注入漏洞

Cisco Intersight is an application platform from Cisco, Inc. provides a level of intelligent management that enables IT organizations to analyze, simplify, and automate their environments in a more advanced way than previous generations of tools. A security vulnerability exists in the Cisco...

SUSE CVE-2020-14196

In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced...

JetBrains IntelliJ IDEA Cross-Site Scripting Vulnerability

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from Jetbrains Czech Republic.A cross-site scripting vulnerability exists in versions prior to JetBrains IntelliJ IDEA 2022.1, which stems from an error message in the internal web server that lacks a...

CVE-2022-29818

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed...

CVE-2022-29817

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible...

CVE-2022-29818

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed...

CVE-2022-29817

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible...

CVE-2022-29817

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible...

Cross site scripting

In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible...

Code injection

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed...

CVE-2022-29818

In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed...