Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the render function used by the My Account widget. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a link including a...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...

Use of Weak Hash

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Use of Weak Hash through the deserialization process. An attacker can cause a denial of service by sending specially crafted data that leads to hash...

PT-2024-32808 · Element · Element Desktop

Name of the Vulnerable Software and Affected Versions: Element Desktop versions 1.11.70 through 1.11.80 Description: The issue concerns a vulnerability in Element Desktop, a Matrix client for desktop platforms, which can lead to the exposure of access tokens to third parties under specially craft...

CVE-2024-45011 affecting package kernel for versions less than 5.15.167.1-1

CVE-2024-45011 affecting package kernel for versions less than 5.15.167.1-1. An upgraded version of the package is available that resolves this issue...

Relative Path Traversal

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Relative Path Traversal due to improper sanitization of the personalityfolder parameter. An attacker can read any folder in the personalityfolder on the victim's computer by...

Always-Incorrect Control Flow Implementation

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the improper handling of the enablemonitoring flag. An attacker can access sensitive application...

Origin Validation Error

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Origin Validation Error due to the CustomCORSMiddleware class. An attacker can make unauthorized requests and potentially access sensitive data...

Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass. A low-privileged attacker could bypass security measures and impact system integrity by exploiting this vulnerability without requiring user...

Improper Privilege Management

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Improper Privilege Management due to improper privilege management in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. An attacker can view and overwrite files by accessing these endpoints...

PT-2024-32706 · Unknown · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime versions through 4.0.4.5 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untrusted sites...

Information Exposure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Information Exposure due to the embedding model update feature under admin settings. An attacker can expose sensitive information by observing error messages that vary based on the file's existence and...

SUSE CVE-2024-43363

Cacti is an open source performance and fault management framework. An admin user can create a device with a malicious hostname containing php code and repeat the installation process completing only step 5 of the installation process is enough, no need to complete the steps before or after it to...

PT-2024-38243 · Progress · Telerik Report Server

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Report Server versions prior to 2024 Q3 10.2.24.806 Description: The issue allows for an HTTP DoS attack on anonymous endpoints without rate limiting. This can potentially lead to service disruption. Recommendations: For...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to untrusted inputs which can influence algorithmically complex operations. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS by a hash flooding attack, due to inefficient array processing when handling URI parts. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS by a hash flooding attack, due to inefficient array processing when handling URI parts. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its intended and...