29413 matches found
CVE-2024-8952 SSRF in composiohq/composio
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...
CVE-2024-8952 SSRF in composiohq/composio
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...
CVE-2024-8952 SSRF in composiohq/composio
A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.2, specifically in the /api/actions/execute/WEBTOOLSCRAPEWEBSITECONTENT endpoint. This vulnerability allows an attacker to read files, access AWS metadata, and interact with local services on the system...
CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...
CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify
langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...
PT-2025-12129
Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version git 2c68a13 Description A Server-Side Request Forgery SSRF issue was identified, allowing an attacker to access internal server resources and data, such as AWS metadata credentials, that are otherwise inaccessible...
GPT Academic 代码问题漏洞
GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a server-side request forgery vulnerability that can be exploited by an attacker to cause an application to access any URL, including internal services, and...
CBL Mariner 2.0 Security Update: azure-iot-sdk-c (CVE-2024-29195)
The version of azure-iot-sdk-c installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29195 advisory. - The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This...
Open WebUI 代码问题漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A code issue vulnerability exists in Open WebUI version 0.3.8, which stems from server-side request forgery and could lead to internal services being accessed...
D-Link DIR-605L和D-Link DIR-618 安全漏洞
The D-Link DIR-605L and D-Link DIR-618 are both a wireless router from China-based AUO D-Link. An Access Control Error vulnerability exists in the D-Link DIR-605L and D-Link DIR-618 that stems from improper access control of the file /goform/formVirtualServ, which can be exploited by an attacker ...
PT-2025-12198
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. Specifically, the /openai/models endpoint is affected, allowing an attacker to change the OpenAI URL to any URL without checks...
DRUPAL-CORE-2025-004
Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...
DRUPAL-CONTRIB-2025-025
This module can be used to render Open API Documentation using the RapiDoc library. The module provides a custom formatter for link fields. Drupal core does not sufficiently sanitize link element attributes, which can lead to a Cross Site Scripting vulnerability XSS. A separate fix for Drupal cor...
Important: Red Hat Security Advisory: thunderbird security update
An update for thunderbird is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update ...
This Week in Spring – March 18th, 2025
Hi, Spring fans! I just got back from the amazing JavaOne show held in Redwood Shores. It was a fun, uproarious event and a great chance to reconnect with tons of friends, old and new. I love this community! One of the central highlights of this show? Java 24 is here, finally! And, as usual, we'v...
The vulnerability of Remote Desktop Services (RDS) for Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of Remote Desktop Services RDS for Windows operating systems is related to the use of unsafe mechanisms for processing authentication data in the operating system’s memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
SQL Injection Vulnerability in UFIDA BIP of UFIDA Network Technology Co.
UFIDA is a leading provider of management software, ERP software, group management software, human resource management software, customer relationship management software, small business management software, financial and administrative institution management software, automotive industry...
CVE-2025-2386 PHPGurukul Local Services Search Engine Management System serviceman-search.php sql injection
A vulnerability was found in PHPGurukul Local Services Search Engine Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /serviceman-search.php. The manipulation of the argument location leads to sql injection. The attack may be initiated...
PHPGurukul Local Services Search Engine Management System 安全漏洞
PHPGurukul Local Services Search Engine Management System is a local services search engine management system from PHPGurukul Inc. A security vulnerability exists in PHPGurukul Local Services Search Engine Management System version 1.0, which stems from an incorrect manipulation of the parameter...