5906 matches found
CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...
polyaxon 安全漏洞
Polyaxon is an open source platform designed to simplify the lifecycle management of machine learning and deep learning projects. Polyaxon suffers from a container escape vulnerability that can be exploited by attackers to compromise the confidentiality, availability, and integrity of the system...
Vulnerability of the mtk_drm_bind() function in the drivers/gpu/drm/mediatek/mtk_drm_drv.c module – This driver provides support for Direct Rendering Infrastructure (DRI) in Mediatek graphics cards in Linux operating systems. It allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
Vulnerability of the mtkdrmbind function in the drivers/gpu/drm/mediatek/mtkdrmdrv.c module – The DRI driver for Mediatek graphics cards in Linux operating systems relies on the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
Critical vulnerabilities in SICK DL100-2xxxxxxx
Critical vulnerabilities have been found in the SICK device DL100-2xxxxxxx. If exploited, this potentially allows an attacker to impact availabiltiy, integrity and confidentaility of the products. Currently, SICK is not aware of any public exploits specifically targeting these vulnerabilities. As...
CVE-2024-54085
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...
CVE-2025-26661
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58045
Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-51947
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-51945
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58044
Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58045
Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58044
Permission verification bypass vulnerability in the notification module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58048
CVE-2024-58048 documents describe a multi-threading issue described as a competitive condition vulnerability in Huawei HarmonyOS (and related components). The core problem is a race/synchronization condition in the package management/module workflow that could enable an attacker to exploit the ra...