CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy ...

CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy ...

CVE-2024-2178 Path Traversal Vulnerability in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy ...

CVE-2024-2178: Path Traversal: '\..\filename'

A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copytocustompersonas' endpoint in the 'lollmspersonalitiesinfos.py' file. This vulnerability allows attackers to read arbitrary files by manipulating the 'category' and 'name' parameters during the 'Copy ...

CVE-2024-4330

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

CVE-2024-4330 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

LoLLMs Cross-Site Scripting Vulnerability

LoLLMs is a web UI for large language multimodal systems by Saifeddine ALOUI individual developer. LoLLMs suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a crafted payload...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by Saifeddine ALOUI Personal Developer. A path traversal vulnerability exists in LoLLMs version 9.6, which stems from the listpersonalities endpoint mishandling user-supplied input, and can be exploited by an attacker to traverse the...

PT-2024-30466

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version 9.6 Description A path traversal issue was identified due to improper handling of user-supplied input in the "list personalities" endpoint. An attacker can craft a malicious HTTP request to traverse the directory...

CVE-2024-4330: Relative Path Traversal

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

Arbitrary Code Execution

Parisneo/lollms is vulnerable to Arbitrary Code Execution. The vulnerability is due to insufficient sanitization of user input in the handling of the name parameter within the unInstallbinding function, allowing an attacker to traverse directories and execute arbitrary code by loading a malicious...

CVE-2024-4267

A remote code execution RCE vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this...

CVE-2024-4267

A remote code execution RCE vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this...

CVE-2024-4267 Remote Code Execution in parisneo/lollms-webui

A remote code execution RCE vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this...

LoLLMs 命令注入漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A command injection vulnerability exists in LoLLMs that stems from the openfile function not neutralizing special elements used in user uploaded commands...

PT-2024-30098 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version 9.5 Description: A remote code execution vulnerability exists in the parisneo/lollms-webui, specifically within the open file module. The vulnerability arises due to improper neutralization of special elements us...

CVE-2024-4267: Improper Neutralization of Special Elements used in a Command

A remote code execution RCE vulnerability exists in the parisneo/lollms-webui, specifically within the 'openfile' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'openfile' function. An attacker can exploit this...

LoLLMS Command Injection vulnerability

A vulnerability in the parisneo/lollms, specifically in the /unInstallbinding endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the name parameter in the unInstallbinding function, allowi...

CVE-2024-4078

A vulnerability in the parisneo/lollms, specifically in the /unInstallbinding endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the name parameter in the unInstallbinding function, allowi...

CVE-2024-3435

A path traversal vulnerability exists in the 'savesettings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'applysettings' function, allowing an...