12869 matches found
CVE-2024-8101 Stored XSS in aimhubio/aim
A stored cross-site scripting XSS vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be...
CVE-2024-12778
CVE-2024-12778 affects the Aim project (aimhubio/aim) v3.25.0. The root cause is an absence of a limit on the number of metrics requested per call, which, together with a single-threaded server, allows excessive resource consumption and can render the web API unresponsive (DoS). Concretely, retri...
CVE-2024-6851 Arbitrary File Deletion in aimhubio/aim
In version 3.22.0 of aimhubio/aim, the LocalFileManager.cleanup function in the aim tracking server accepts a user-specified glob-pattern for deleting files. The function does not verify that the matched files are within the directory managed by LocalFileManager, allowing a maliciously crafted...
CVE-2024-9900 Cross-Site Scripting (XSS) in mudler/localai
mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...
CVE-2024-13877
creationtimestamp| type| source ---|---|--- 2025-03-20 06:18:06+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8174 2025-03-20 09:02:11+00:00| seen| https://t.me/cvedetector/20693 2025-03-20 09:03:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lksdomessz2s...
PT-2025-12026
Name of the Vulnerable Software and Affected Versions aimhubio/aim version 3.23.0 Description The ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main thread being blocked indefinitely. This results in a denial of service as the...
CVE-2025-27777
creationtimestamp| type| source ---|---|--- 2025-03-19 23:00:29+00:00| seen| https://t.me/cvedetector/20678 2025-03-19 23:33:40+00:00| published-proof-of-concept| Telegram/HMG4VIRM9m-XCFs0EcofkvAyhAqbRpFenRbXfQ1LU4Gb4E 2025-03-20 00:49:07+00:00| seen|...
CVE-2025-27782
creationtimestamp| type| source ---|---|--- 2025-03-19 23:00:21+00:00| seen| https://t.me/cvedetector/20672 2025-03-19 23:33:39+00:00| published-proof-of-concept| Telegram/e8K6ei2MJobaYeBw9lEyjrqpWhjWmsfq7ceAEPONUHatpcs 2025-03-20 00:49:11+00:00| seen|...
CVE-2025-27777
Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery SSRF in modeldownload.py line 195 in 3.2.7. The blind SSRF allows for sending requests on behalf of Applio server and can be leveraged to probe for other vulnerabilities on the server itself ...
CVE-2025-30258
In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags, the user loses the ability to verify signatures made from certain other signing keys, aka a "verification DoS."...
CVE-2025-29924
creationtimestamp| type| source ---|---|--- 2025-03-19 19:06:22+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114190659236671973 2025-03-19 20:00:51+00:00| published-proof-of-concept| Telegram/pKc-k4S4UpucBi-A8jZui2WxqHw-KLQAnPldAvhIPnjHqVQ 2025-03-19 20:18:15+00:00|...
CVE-2024-21116
creationtimestamp| type| source ---|---|--- 2025-03-19 18:19:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8104...
CVE-2024-53969
Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting XSS vulnerability that could be exploited to execute arbitrary code in the context of the victim's browser session. By manipulating the DOM environment in the victim's browser, a low privileged...
CVE-2025-23382
Dell Secure Connect Gateway SCG 5.0 Appliance - SRS, versions 5.26, contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.c...
CVE-2025-27018
creationtimestamp| type| source ---|---|--- 2025-03-19 09:49:02+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8037 2025-03-19 10:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkpysbitl52j 2025-03-19 12:08:28+00:00| seen|...
CVE-2025-24799
GLPI is a free asset and IT management software package. An unauthenticated user can perform a SQL injection through the inventory endpoint. This vulnerability is fixed in 10.0.18...
CVE-2025-25040
CVE-2025-25040 affects HPE Aruba CX 9300 CX-9300 switches running AOS-CX. The issue is in port ACL enforcement on routed ports for egress traffic, allowing bypass of ACLs and potential unauthorized traffic flow. Affected: AOS-CX 10.14.xxxx (all patches) and 10.15.xxxx (10.15.1000 and below). Not ...
CVE-2025-30110
creationtimestamp| type| source ---|---|--- 2025-03-18 17:44:12+00:00| seen| https://t.me/cvedetector/20578 2025-03-18 18:13:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkobicrxkw26 2025-03-21 17:19:19+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/8...
CVE-2025-1468
creationtimestamp| type| source ---|---|--- 2025-03-18 13:01:22+00:00| seen| Telegram/6cbUuW0XOy9-5cfzVYZy-1D70VP0VBBmnHLM6kTk1XKO28 2025-03-18 13:21:14+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114183639798780722 2025-03-18 13:33:35+00:00| seen| https://t.me/cvedetector/20563...