CVE-2024-37145: Improper Neutralization of Input During Web Page Generation

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-36423: Improper Neutralization of Input During Web Page Generation

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/public-chatflows/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to...

CVE-2024-36421: Origin Validation Error

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, A CORS misconfiguration sets the Access-Control-Allow-Origin header to all, allowing arbitrary origins to connect to the website. In the default configuration unauthenticated,...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

CVE-2024-33858

An issue was discovered in Logpoint before 7.4.0. A path injection vulnerability is seen while adding a CSV enrichment source. The sourcename parameter could be changed to an absolute path; this will write the CSV file to that path inside the /tmp directory...

PT-2024-25513 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: A path injection issue is present when adding a CSV enrichment source. The source name parameter can be modified to an absolute path, allowing the CSV file to be written to that path inside the /t...

CVE-2024-33858

Logpoint versions prior to 7.4.0 are vulnerable to a path injection vulnerability when adding a CSV enrichment source. The root cause is that the source_name parameter can be manipulated to accept an absolute path, allowing an attacker to write the CSV file to a specific location within the /tmp ...

SUSE CVE-2024-1681

corydolphin/flask-cors is vulnerable to log injection when the log level is set to debug. An attacker can inject fake log entries into the log file by sending a specially crafted GET request containing a CRLF sequence in the request path. This vulnerability allows attackers to corrupt log files,...

CVE-2024-32024

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py addprepostfix function. This vulnerability is fixed in 23.1.5...

CVE-2024-32023

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py findandreplace function. This vulnerability is fixed in 23.1.5...

CVE-2024-32024

Kohya_ss (GUI for Kohya’s Stable Diffusion trainers) is affected by a path-injection vulnerability in the common_gui.py function add_pre_postfix. Public sources consistently identify this flaw as present in versions up to 23.1.3/22.6.1 and fixed in 23.1.5. The root cause involves unsafe path hand...

CVE-2024-32024

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the "commongui.py" "addprepostfix" function. This vulnerability is fixed in 23.1.5...

CVE-2024-32024 Kohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py addprepostfix function. This vulnerability is fixed in 23.1.5...

CVE-2024-32024 Kohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py addprepostfix function. This vulnerability is fixed in 23.1.5...

CVE-2024-32024 Kohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py addprepostfix function. This vulnerability is fixed in 23.1.5...

CVE-2024-32023

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the "commongui.py" "findandreplace" function. This vulnerability is fixed in 23.1.5...

CVE-2024-32023 Kohya_ss vulnerable to path injection in `common_gui.py` `find_and_replace` function (`GHSL-2024-024`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py findandreplace function. This vulnerability is fixed in 23.1.5...

CVE-2024-32023

Kohya_ss (GUI for Kohya’s Stable Diffusion trainers) is affected by a path injection vulnerability in the common_gui.py find_and_replace function. The issue exploits improper path handling and is fixed in version 23.1.5. Affected versions precede 23.1.5; upgrading to 23.1.5 is the recommended rem...