4983 matches found
CVE-2025-41270: Improper Neutralization of Special Elements used in an OS Command
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating...
CVE-2025-41266: Improper Neutralization of Special Elements used in an OS Command
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating syste...
Waterfall WF-500 操作系统命令注入漏洞
The Waterfall WF-500 is a sending-side host component in the industrial control network unidirectional security gateway developed by the Israeli company Waterfall. Version 7.9.1.0 R2502171040 of the Waterfall WF-500 RX Host contains an operating system command injection vulnerability. This...
CVE-2025-41274: Improper Neutralization of Special Elements used in an OS Command
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating...
The vulnerability of the validate_url() function in the Open WebUI AI-based web interface allows a attacker to perform an SSRF attack.
The vulnerability of the validateurl function in the Open WebUI AI-based web interface is related to insufficient validation of requests at the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...
The vulnerability of the Open WebUI web interface, related to deficiencies in the authentication process, allows a perpetrator to gain access to read and modify data.
The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to gain access to read and modify data remotely...
The vulnerability of the DOMPurify.sanitize() function in the Open WebUI AI-based web interface allows attackers to perform cross-site scripting (XSS) attacks.
The vulnerability of the DOMPurify.sanitize function in the Open WebUI AI-based web interface is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the Open WebUI web interface, related to deficiencies in the authentication process, allows attackers to circumvent existing security restrictions.
The vulnerability of the Open WebUI web interface, based on artificial intelligence, is related to deficiencies in the authentication process when processing the bypassfilter parameter for endpoints like /openai/chat/completions and /ollama/api/chat. Exploiting this vulnerability allows a malicio...
The vulnerability in the Open WebUI web interface allows attackers to perform cross-site scripting attacks (XSS).
The vulnerability in the Open WebUI web interface is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
The vulnerability of the update_message_by_id() function in the Open WebUI AI-based web interface allows a hacker to gain access to read, modify, or delete data.
The vulnerability of the updatemessagebyid function in the Open WebUI AI-based web interface relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an attacker to gain access to read, modify, or delete data...
CVE-2026-21785
A misconfigured Content Security Policy CSP in HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources...
CVE-2026-21785: Improper Restriction of Rendered UI Layers or Frames
A misconfigured Content Security Policy CSP in HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier fails to define directives without fallbacks, allowing attackers to bypass intended security restrictions and load unauthorized resources...
HCL BigFix Remote Control Server WebUI 安全漏洞
HCL BigFix Remote Control Server WebUI is a web interface provided by the Indian company HCL for remote management and control. HCL BigFix Remote Control Server WebUI versions 10.1.0.0442 and earlier have security vulnerabilities. These vulnerabilities stem from incorrect configuration of content...
[SECURITY] Fedora 42 Update: nodejs-aw-webui-0^20260516.8d9a7f8-1.fc42
A web-based UI for ActivityWatch, built with Vue.js...
[SECURITY] Fedora 44 Update: nodejs-aw-webui-0^20260516.8d9a7f8-1.fc44
A web-based UI for ActivityWatch, built with Vue.js...
The vulnerability of the Open WebUI web interface, based on artificial intelligence, arises from deficiencies in the authentication process, allowing attackers to execute arbitrary code.
The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the validate_url() function (backend/open_webui/retrieval/web/utils.py) in the Open WebUI AI-based web interface allows a attacker to perform an SSRF attack.
The vulnerability of the validateurl function backend/openwebui/retrieval/web/utils.py in the Open WebUI AI-based web interface is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...
The vulnerability in the Open WebUI web interface, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks (XSS).
The vulnerability of the Open WebUI web interface is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using a specially created URL address...
The vulnerability in the Open WebUI web interface, related to the mechanism for restricting access to API keys, allows attackers to bypass existing security measures and gain unauthorized access to protected information.
The vulnerability in the Open WebUI web interface is related to the mechanism for restricting access to API keys. Exploiting this vulnerability allows a malicious actor to bypass existing security measures and gain unauthorized access to protected information...
The vulnerability of the PDF-generation function in the Open WebUI web interface allows a attacker to perform an SSRF attack.
The vulnerability of the PDF file generation function in the Open WebUI web interface is related to insufficient validation of requests at the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...