CVE-2024-2548

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollmscore/lollms/server/endpoints/lollmsbindingfilesserver.py and lollmscore/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using...

CVE-2024-2548 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollmscore/lollms/server/endpoints/lollmsbindingfilesserver.py and lollmscore/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using...

CVE-2024-2548 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollmscore/lollms/server/endpoints/lollmsbindingfilesserver.py and lollmscore/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using...

CVE-2024-2548 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the lollmscore/lollms/server/endpoints/lollmsbindingfilesserver.py and lollmscore/lollms/security.py files. Due to inadequate validation of file paths between Windows and Linux environments using...

CVE-2024-2362 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

CVE-2024-2362 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

CVE-2024-2362

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

CVE-2024-2362

The CVE-2024-2362 entry concerns parisneo/lollms-webui versión 9.3 on Windows, with a path traversal vulnerability in the del_preset endpoint due to inadequate input sanitization. The issue permits an attacker to delete files outside the intended directory by supplying absolute or traversal path...

CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...

CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...

CVE-2024-5482

A Server-Side Request Forgery SSRF vulnerability exists in the 'addwebpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs,...

CVE-2024-2362: Absolute Path Traversal

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

PT-2024-21311 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.4 Description: A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the /switch personal path endpoint in ./lollms-webui/lollms...

PT-2024-36425 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest Description: A Server-Side Request Forgery SSRF vulnerability exists in the "add webpage" endpoint, allowing attackers to input arbitrary URLs, including those targeting internal resources such as localhos...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from a path traversal vulnerability in the application...

PT-2024-25779

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 9.6 Description A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitize path from endpoint and sanitize path functions in lollms corelollmssecurity.py. This...

CVE-2024-4881: Absolute Path Traversal

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse...

PT-2024-19596 · Lollms · Lollms

Name of the Vulnerable Software and Affected Versions: Lollms versions up to 7.3.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the profile picture upload functionality of the Lollms application. This vulnerability allows attackers to change a victim's profile picture...

LoLLMs Code Issue Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a code issue vulnerability that stems from not adequately validating user-entered URLs and a server-side request forgery SSRF vulnerability that could allow an attacker to...

CVE-2024-2359: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code. The issue arises from the application's handling of the /executecode endpoint, which is intended to be blocked from external access by default. However,...