4416 matches found
Ollama < 0.4.0 Remote Code Execution
According to the self-reported version in its response header, the version of Ollama hosted on the remote web server is 0.4.0. It is, therefore, affected by a Remote Code Execution. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reporte...
CVE-2025-24367
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed...
CVE-2025-24357 vLLM allows a malicious model RCE by torch.load in hf_model_weights_iterator
vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...
CVE-2025-24367
Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. This vulnerability is fixed...
Remote Code Execution (RCE)
system.linq.dynamic.core is vulnerable to Remote code execution RCE. The vulnerability is due to insufficient input validation and improper access control when handling reflection types and static properties/fields in the System.Linq.Dynamic.Core library, allows remote access without proper...
CVE-2024-35112
IBM Sterling Control Center (IBM Control Center) versions 6.2.1 and 6.3.1 are affected by CVE-2024-35112. The issue stems from improper handling of error messages, where detailed browser error responses could disclose sensitive information, aided by a vulnerability in neutralizing script-related ...
CVE-2019-15690
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution...
CVE-2019-15690
LibVNCServer 0.9.12 release and earlier contains heap buffer overflow vulnerability within the HandleCursorShape function in libvncclient/cursor.c. An attacker sends cursor shapes with specially crafted dimensions, which can result in remote code execution...
PT-2025-5691
Name of the Vulnerable Software and Affected Versions: libcurl versions using zlib 1.2.0.3 or older Description: The issue is related to automatic gzip decompression of content-encoded HTTP responses with the CURLOPT ACCEPT ENCODING option. An attacker-controlled integer overflow can cause libcur...
Ubuntu 24.04 LTS / 24.10 : Python vulnerability (USN-7219-1)
The remote Ubuntu 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7219-1 advisory. It was discovered that Python incorrectly handled asyncio write buffers. A remote attacker could possibly use this issue to cause Python to consume memory...
CVE-2024-45662
IBM Safer Payments is affected by CVE-2024-45662 due to improper allocation of resources that can enable a remote attacker to cause a Denial of Service. Affected versions include 6.4.0.00–6.4.2.07, 6.5.0.00–6.5.0.05, and 6.6.0.00–6.6.0.03. IBM’s bulletin lists remediations: update to 6.4.2.08, 6....
CVE-2025-0530 code-projects Job Recruitment _feedback_system.php cross site scripting
A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /parse/feedbacksystem.php. The manipulation of the argument type leads to cross site scripting. The attack can be initiated remotely. The exploit...
CVE-2024-54660
A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the...
CVE-2018-25108
CVE-2018-25108 affects WAGO 750-8xx programmable logic controllers. An unauthenticated remote attacker can cause a DoS by triggering uncontrolled resource consumption in the controller, leading to unavailability. The threat context is network-based (no user interaction) with no privileges require...
CVE-2025-0457
The airPASS from NetVision Information has an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject and execute arbitrary OS commands...
CVE-2024-47605 - XSS via insert media remote file oembed
More info at https://www.silverstripe.org/download/security-releases/cve-2024-47605...
CVE-2025-21338
GDI+ Remote Code Execution Vulnerability...
CVE-2025-21186
Microsoft Access Remote Code Execution Vulnerability...