PT-2024-18108 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: An issue exists in the '/open code folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the discussion id parameter...

CVE-2024-1602: Improper Neutralization of Input During Web Page Generation

parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting XSS that leads to Remote Code Execution RCE. The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within t...

CVE-2024-1522 Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

CVE-2024-1522 Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

CVE-2024-1522

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the "/executecode" API endpoint, which does not properly validate requests, enabling an attacker to craft a...

CVE-2024-1522: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

PT-2024-18110 · Unknown · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: lollms-webui affected versions not specified Description: A Cross-Site Request Forgery CSRF issue in the lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The issue stems from the "/execute code" API...

PT-2024-3607 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: Open WebUI versions prior to 0.1.117 Description: The issue is related to an authenticated blind server-side request forgery vulnerability. It involves the download file stream function in the backend/apps/web/routers/utils.py file of the Ope...

CVE-2024-0800

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

Path traversal

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

CVE-2024-0800 Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

Arcserve Unified Data Protection Path Traversal Vulnerability

Arcserve Unified Data Protection is Arcserve's all-in-one data and ransomware protection solution. A path traversal vulnerability exists in Arcserve Unified Data Protection versions 9.2 and 8.1, which originates from edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet. Path...

Arcserve Unified Data Protection Security Vulnerability

Arcserve Unified Data Protection is Arcserve's all-in-one data and ransomware protection solution. A security vulnerability exists in Arcserve Unified Data Protection versions 9.2 and 8.1, which originates in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server. An authentication...

PT-2024-2416 · Parisneo +1 · Lollms-Webui +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version v9.8 Description: The issue is related to the missing client id parameter in lollms binding infos, leading to security vulnerabilities. Specifically, the endpoints "/reload binding", "/install binding", "/reinsta...

PT-2024-2313

Name of the Vulnerable Software and Affected Versions Arcserve Unified Data Protection versions 8.1 through 9.2 Description An authentication bypass issue exists in the EdgeLoginServiceImpl.doLogin function within wizardLogin, allowing a remote attacker to bypass the authentication process. This...

openSUSE: Security Advisory for chromium (openSUSE-SU-2022:10086-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Rspamd < 1.6.3 XSS Vulnerability

Rspamd is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:rspamdproject:rspamd...

Cross-Site Scripting (XSS)

sidekiq-unique-jobs is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper parameter sanitization within GET request to the admin webUI. This allows an attacker with super-user permission to execute arbitrary JavaScript code in the browser...

PT-2024-5517 · Microsoft · Visual Studio Code

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: The LoLLMS WebUI system for launching and managing large language models is susceptible to a denial of service DoS attack due to uncontrolled resource consumption. Attackers c...

Denial Of Service

chromium is vulnerable to Denial Of Service. The vulnerability is due to an integer underflow in WebUI. A remote attacker can potentially exploit heap corruption via a malicious file...