PT-2024-38313 · WordPress · Acymailing

Name of the Vulnerable Software and Affected Versions: AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress versions up to, and including, 9.7.2 Description: The issue is related to arbitrary file uploads due to missing file type validation in the acym...

Squirrelly 安全漏洞

Squirrelly is a modern, configurable, and ultra-fast template engine implemented in JavaScript by Squirrelly Open Source. A security vulnerability exists in Squirrelly version v9.0.0, which stems from the discovery of a contained code injection vulnerability via the component options.varName...

IBM WebSphere Application Server 信任管理问题漏洞

IBM WebSphere Application Server WAS is an application server product from International Business Machines IBM. The product is a platform for JavaEE and Web services applications and is the foundation of the IBM WebSphere software platform. A trust management issue vulnerability exists in IBM...

TOTOLINK X5000R 操作系统命令注入漏洞

The TOTOLINK X5000r is a wireless router manufactured by TOTOLINK. TOTOLINK X5000r has a command injection vulnerability in version 9.1.0cu.2350b20230313. The vulnerability arises because the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi file fails to properly validate or clean up...

TOTOLINK X5000R 操作系统命令注入漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setUPnPCfg method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special...

CVE-2024-21154

Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft component: Human Resources. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise H...

CVE-2024-21122

Vulnerability in the PeopleSoft Enterprise HCM Shared Components product of Oracle PeopleSoft component: Text Catalog. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise HC...

EcoStruxure Foxboro DCS Core Control Services Buffer Error Vulnerability

Schneider Electric EcoStruxure Foxboro DCS is an innovative fault-tolerant, highly available control component from Schneider Electric France. A buffer error vulnerability exists in EcoStruxure Foxboro DCS Core Control Services 9.8 and prior versions, which stems from the presence of an...

Gallagher Command Centre security breach

Gallagher Command Centre is a centralized control tool for Gallagher access control systems from Gallagher New Zealand. A security vulnerability exists in Gallagher Command Centre vEL9.10.1268 MR1 prior to v9.10, which stems from an improperly neutralized log output may give an attacker limited...

CVE-2024-35154

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM...

CVE-2024-32854

Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to privilege escalation...

PT-2024-24279 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.3 LTS and 9.3 CD Description: The issue allows an authenticated user to escalate their privileges under certain configurations due to incorrect privilege assignment. Recommendations: For IBM MQ versions 9.3 LTS and 9.3 CD, a...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version 9.6 that stems from vulnerability to a path traversal attack, which allows an attacker to write an audio file to an arbitrary location on the...

TYPO3 Security Vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions prior to 8.3.8, and 9.x versions prior to 9.0.6, which stems from the presence of an insecure direct object reference IDOR vulnerability,...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version 9.5, which stems from insufficient path cleanup and vulnerability to local file inclusion attacks...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version v9.6, which stems from the use of a GET request to clear a list of personalized files that lacks proper cross-site request...

LoLLMs Operating System Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An operating system command injection vulnerability exists in LoLLMs version 9.3 that stems from improper neutralization of special elements used in operating system commands, which could allow...

PT-2024-25779

Name of the Vulnerable Software and Affected Versions parisneo/lollms versions prior to 9.6 Description A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitize path from endpoint and sanitize path functions in lollms corelollmssecurity.py. This...

PT-2024-33236 · Parisneo · Lollms

Name of the Vulnerable Software and Affected Versions: parisneo/lollms versions prior to 9.5.0 Description: A path traversal vulnerability exists due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by Saifeddine ALOUI Personal Developer. A path traversal vulnerability exists in LoLLMs version 9.6, which stems from the listpersonalities endpoint mishandling user-supplied input, and can be exploited by an attacker to traverse the...