13826 matches found
CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability
An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...
CVE-2021-27703
CVE-2021-27703 affects Sercomm Model Etisalat Model S3-AC2100; the vulnerability is Cross Site Scripting (XSS) via the firmware update page. Documented impact is limited to XSS with no exploitation details provided; remediation cited across sources is to update to the latest firmware version. No ...
CVE-2021-27702
Sercomm Router Etisalat Model S3- AC2100 is affected by Incorrect Access Control via the diagnostic utility in the router dashboard...
CVE-2021-27702
CVE-2021-27702 affects the Sercomm Router Etisalat Model S3-AC2100. The issue is an Incorrect Access Control via the diagnostic utility in the router dashboard . The CVSS 3.1 base metrics indicate a High severity (7.3), with attack vector Adjacent, attack complexity Low, privileges required Low, ...
Decidim-Awesome has SQL injection in AdminAccountability
Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component:...
PT-2024-30573 · Unknown · Decidim Awesome-Module
Name of the Vulnerable Software and Affected Versions: decidim awesome-module versions 0.9.0 through 0.11.1 Description: An improper neutralization of special elements used in an SQL command in the papertrail/version-model of the decidim awesome-module allows an authenticated admin user to...
CVE-2024-52353
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects allows DOM-Based XSS.This issue affects Christian Science Bible Lesson Subjects: from n/a through 2.0...
D-Link DSL6740C 安全漏洞
The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from a path traversal vulnerability that stems from the program failing to properly filter special elements in the path of a resource or file. An attacker could exploit this vulnerability to cau...
The vulnerability of the libodx.dll library in the AutoCAD modeling, design, and drawing software allows a perpetrator to cause an unexpected termination of the application or execute arbitrary code.
The vulnerability of the libodx.dll library in AutoCAD simulation, design, and drawing software relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow an attacker to cause the application to terminate abnormally or execute arbitrary code using a...
The vulnerability of the Modbus TCP interface of the microprogramming software used in multifunctional measuring instruments for measuring electrical network parameters from Siemens SENTRON 7KM PAC3200 allows a perpetrator to circumvent existing security restrictions and gain unauthorized access to protected information.
The vulnerability of the Modbus TCP interface of Siemens SENTRON 7KM PAC3200 multifunctional measuring instruments for measuring electrical network parameters lies in improper authentication mechanisms. This includes insufficient security measures, such as a weak 4-digit PIN code, and the absence...
The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drafting software allows a perpetrator to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.
The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drafting software relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information, execute...
CVE-2024-11047
A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been declared as critical. Affected by this vulnerability is the function upgradefilterasp of the file /upgradefilter.asp. The manipulation of the argument path leads to stack-based buffer overflow. The attack can be launched remotely...
Remote Code Execution via Model Deserialization on /api/v2/models/install API
Summary I have identified a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization. The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation. This...
PT-2024-34741 · Unknown · Kendysond Selar.Co Widget
Name of the Vulnerable Software and Affected Versions: Kendysond Selar.Co Widget versions n/a through 1.2 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS vulnerability, allowing DOM-Based XSS. This means...
AI Industry is Trying to Subvert the Definition of “Open Source AI”
The Open Source Initiative has published news article here its definition of "open source AI," and it's terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret. Since for a neural network, the training data is the source code--it's how the model...
Integer Overflow In /v2/repository/models/<model_name>/load
This report is not public...
SUSE CVE-2024-48057
localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...
RHEL 8 : nodejs:20 (RHSA-2024:5814)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5814 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...