@haxtheweb/create (>=10.0.0 <=11.0.2), @haxtheweb/open-apis (=11.0.2) potentially affected by CVE-2025-48996 via @haxtheweb/open-apis (=10.0.1)

@haxtheweb/open-apis NPM version =10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on @haxtheweb/open-apis and may be impacted: - @haxtheweb/create =10.0.0, =11.0.2 - @haxtheweb/open-apis =11.0.2 Source cves: CVE-2025-48996 Source advisory:...

CVE-2024-57783

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML in render.js, and because the Electron window can access Node.js APIs...

Cisco Meraki Data Collection

Collects Cisco Meraki Device data from the Cisco Meraki Dashboard host using the REST APIs. TRUSTED...

CVE-2025-48996 Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint

HAX open-apis provides microservice apis for HAX webcomponents repo that are shared infrastructure calls. An unauthenticated information disclosure vulnerability exists in the Penn State University deployment of the HAX content management system via the haxPsuUsage API endpoint, related to a flat...

CVE-2024-57783

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML in render.js, and because the Electron window can access Node.js APIs...

open-apis 安全漏洞

open-apis is a microservices API for the HAX Web Component Repository open-sourced by HAX The Web. A security vulnerability exists in open-apis version 10.0.2 and earlier, which stems from the disclosure of unauthenticated information and could lead to the disclosure of website listings...

CVE-2024-57783

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML in render.js, and because the Electron window can access Node.js APIs...

CVE-2024-57783

CVE-2024-57783 affects the Dot desktop app up to version 0.9.3. The vulnerability enables XSS and potential command execution because user input and LLM output are appended to the DOM via innerHTML in render.js, and the Electron window can access Node.js APIs. Affected: Dot 0.9.3 and earlier. Imp...

CVE-2024-57783

The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML in render.js, and because the Electron window can access Node.js APIs...

CVE-2024-5957

This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager...

CVE-2024-23687

Hard-coded credentials in FOLIO mod-data-export-spring versions before 1.5.4 and from 2.0.0 to 2.0.2 allows unauthenticated users to access critical APIs, modify user data, modify configurations including single-sign-on, and manipulate fees/fines...

CVE-2024-0088

NVIDIA Triton Inference Server for Linux contains a vulnerability in shared memory APIs, where a user can cause an improper memory access issue by a network API. A successful exploit of this vulnerability might lead to denial of service and data tampering...

CVE-2024-24569

The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. ZipSecurityisBelowCurrentDirectory is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version =1.1.1, use ZipSecurity as a guard against...

CVE-2024-23386

memory corruption when WiFi display APIs are invoked with large random inputs...

CVE-2023-1837

Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legacy APIs.This issue affects HYPR Server: before 8.0 with enabled Legacy APIs...

CVE-2023-41904

Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass for AuthToken generation in REST APIs...

CVE-2023-34156

Vulnerability of services denied by early fingerprint APIs on HarmonyOS products.Successful exploitation of this vulnerability may cause services to be denied...

CVE-2023-33236

MXsecurity version 1.0 is vulnearble to hardcoded credential vulnerability. This vulnerability has been reported that can be exploited to craft arbitrary JWT tokens and subsequently bypass authentication for web-based APIs...

CVE-2022-3939

A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely...

CVE-2022-3940

A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument filename leads to path traversal. The associated identifier of this vulnerability is VDB-213447...