CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level manager, admin, and when in single user could put in the URL http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance which is a special IP and URL th...

CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level manager, admin, and when in single user could put in the URL http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance which is a special IP and URL th...

CVE-2024-0455

CVE-2024-0455 concerns AnythingLLM where a web scraper can trigger a server-side request to the AWS EC2 metadata URL 169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance. If accessed by a user with manager/admin permissions (and in single-user mode) from wit...

CVE-2024-0455: Server-Side Request Forgery (SSRF)

The inclusion of the web scraper for AnythingLLM means that any user with the proper authorization level manager, admin, and when in single user could put in the URL http://169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance which is a special IP and URL th...

PT-2024-15574 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: The issue allows users with proper authorization levels manager, admin, and when in single user mode to access sensitive information by using a web scraper to query a specific URL:...

dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2023-50447 via pillow (3.4.2)

pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2023-50447 Sour...

CVE-2023-48699 fastbots Eval Injection vulnerability

fastbots is a library for fast bot and scraper development using selenium and the Page Object Model POM design. Prior to version 0.1.5, an attacker could modify the locators.ini locator file with python code that without proper validation it's executed and it could lead to rce. The vulnerability ...

dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2023-44271 via pillow (3.4.2)

pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2023-44271 Sour...

carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2023-46137 via twisted (22.4.0)

twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2023-46137 Source advisory:...

cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2023-46137 via twisted (19.2.1)

twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2023-46137 Source advisory: OSV:GHSA-XC8X-VP79-P3WM...

carml (>=22.7.0, <=22.7.1), clutch-co-scraper (1.0.0) +6 more potentially affected by CVE-2023-46137 via twisted (22.4.0)

twisted PYPI version 22.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml =22.7.0, =4.1.0, =4.0.0rc1, =0.0.1, =0.0.2 - nucypher 6.1.0 - pterodactyl-exporter 0.1.0 Source cves: CVE-2023-46137 Source advisory:...

cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by CVE-2023-46137 via twisted (19.2.1)

twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: CVE-2023-46137 Source advisory: OSV:PYSEC-2023-224...

3b-bot (>=1.0.0b0, <=1.0.0b3), 8a-scraper (>=0.0.2, <=0.0.4) +735 more potentially affected by CVE-2023-5590 via selenium (>=2.42.1, <=4.15.0)

selenium PYPI version =2.42.1, =1.0.0b0, =0.0.2, =0.0.5, =1.0.2, =1.0.6, =1.2.3, =0.1.7, =0.0.11, =1.9.0, =0.1.0, =0.0.1, =2.0.0, =0.2.0, =0.7.0 and more Source cves: CVE-2023-5590 Source advisory: MEND:CVE-2023-5590...

WordPress TwentyFourth WP Scraper Plugin <= 0.6.5 is vulnerable to Cross Site Scripting (XSS)

Software TwentyFourth WP Scraper Type Plugin Vulnerable versions = 0.6.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID f8302abdf1de Credits Rafie Muhammad Patchstack...

basketcase (3.0.2), gridplayer (0.4.3) +1 more potentially affected by CVE-2023-35934 via yt-dlp (2022.7.18)

yt-dlp PYPI version 2022.7.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 3.0.2 - gridplayer 0.4.3 - vk-url-scraper =0.3.8, =0.3.10 Source cves: CVE-2023-35934 Source advisory: OSV:GHSA-V8MC-9377-RWJJ...

vk-url-scraper (>=0.2.1, <=0.3.5) potentially affected by CVE-2023-35934 via yt-dlp (2022.5.18)

yt-dlp PYPI version 2022.5.18 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - vk-url-scraper =0.2.1, =0.3.5 Source cves: CVE-2023-35934 Source advisory: OSV:GHSA-V8MC-9377-RWJJ...

cyclone (>=1.2.0, <=1.3.0), ironman (>=0.5.0, <=0.6.0) +5 more potentially affected by unknown CVE via twisted (19.2.1)

twisted PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - cyclone =1.2.0, =0.5.0, =4.0.1, =1.0.0, =0.1.0a23, =0.1.0, =0.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-8R99-H8J2-RW64...

adsbx_browser (0.1.0), adsbx_screenshot (>=0.1.0, <=1.4.1) +32 more potentially affected by CVE-2022-35922 via websocket (>=0.9.5, <=0.23.0)

websocket CARGO version =0.9.5, =0.1.0, =0.1.3, =0.0.3, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.3, =0.1.0, =0.4.4, =0.5.0 and more Source cves: CVE-2022-35922 Source advisory: OSV:GHSA-QRJV-RF5Q-QPXC...

adsbx_browser (0.1.0), adsbx_screenshot (>=0.1.0, <=1.4.1) +32 more potentially affected by CVE-2022-35922 via websocket (>=0.9.5, <=0.23.0)

websocket CARGO version =0.9.5, =0.1.0, =0.1.3, =0.0.3, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.1.3, =0.1.0, =0.4.4, =0.5.0 and more Source cves: CVE-2022-35922 Source advisory: GHSA-QRJV-RF5Q-QPXC...

Fedora: Security Advisory for golang-github-gocolly-colly-2 (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...