4976 matches found
CVE-2024-3435: Path Traversal: '\..\filename'
A path traversal vulnerability exists in the 'savesettings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'applysettings' function, allowing an...
PT-2024-30422
Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions up to 9.3 Description A vulnerability allows remote attackers to execute arbitrary code due to insufficient protection of the "/apply settings" and "/execute code" endpoints. Attackers can bypass protections by...
CVE-2024-2358: Path Traversal: '\..\filename'
A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...
CVE-2024-2299: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is...
CVE-2024-2299
CVE-2024-2299 describes a stored XSS in the parisneo/lollms-webui profile picture upload due to improper validation of uploaded files. The vulnerability can be triggered by uploading malicious HTML files containing JavaScript, which executes when accessed. It is remotely exploitable via CSRF, ena...
CVE-2024-2299
A stored Cross-Site Scripting XSS vulnerability exists in the parisneo/lollms-webui application due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this vulnerability by uploading malicious HTML files containing JavaScript code, which is...
PT-2024-19635 · Unknown · Lollms-Webui
Name of the Vulnerable Software and Affected Versions: lollms-webui affected versions not specified Description: A stored Cross-Site Scripting XSS issue exists due to improper validation of uploaded files in the profile picture upload functionality. Attackers can exploit this by uploading malicio...
VulnCheck KEV: CVE-2024-0800
A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...
GLSA-202405-14 : QtWebEngine: Multiple Vulnerabilities
The remote host is affected by the vulnerability described in GLSA-202405-14 QtWebEngine: Multiple Vulnerabilities - Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium...
Meinberg LANTIME Remote Code Execution (CVE-2020-7240)
Meinberg Lantime devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated super-user account usi...
Fedora 40 : chromium (2024-8b50ca2e22)
The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8b50ca2e22 advisory. update to 124.0.6367.60 High CVE-2024-3832: Object corruption in V8 High CVE-2024-3833: Object corruption in WebAssembly High CVE-2024-3914: Use aft...
Fedora 38 : chromium (2024-2c9be9d949)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2c9be9d949 advisory. update to 124.0.6367.78 Critical CVE-2024-4058: Type Confusion in ANGLE High CVE-2024-4059: Out of bounds read in V8 API High CVE-2024-4060: Use aft...
Updated chromium-browser-stable packages fix security vulnerabilities
The chromium-browser-stable package has been updated to the 124.0.6367.60 release. It includes 23 security fixes. Please, do note, only x8664 is supported from now on. i586 support for linux was stopped some years ago and the community is not able to provide patches anymore for the latest Chromiu...
The vulnerability in the user interface of Microsoft Edge and Google Chrome browsers allows attackers to circumvent existing security restrictions.
The vulnerability of the WebUI user interfaces of Microsoft Edge and Google Chrome is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...
CVE-2024-3911 Welotec: Clickjacking Vulnerability in WebUI
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames...
CVE-2024-3911 Welotec: Clickjacking Vulnerability in WebUI
An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames...
Security Bypass
chrome is vulnerable to Security Bypass. The vulnerability is due to insufficient policy enforcement in WebUI within Google Chrome, allows a remote attacker to bypass content security policy via a crafted HTML page...
Chromium: CVE-2024-3847 Insufficient policy enforcement in WebUI
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
KLA65692 Multiple vulnerabilities in Microsoft Browser
Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, cause denial of service, bypass security restrictions, spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An...
