5849 matches found
Hitachi Energy RTU500 安全漏洞
Hitachi Energy RTU500 is a series of industrial control components from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Energy RTU500 that stems from a renegotiation of an open IEC61850 TLS connection in a specific time scenario could affect availability...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-10361
The CVE-2024-10361 entry concerns a vulnerability in danny-avila/librechat v0.7.5-rc2 where the /api/files endpoint allows path traversal due to improper input validation, enabling arbitrary file deletion on the server. Affected component: the API files handling logic in LibreChat. Reported impac...
CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...
polyaxon 安全漏洞
Polyaxon is an open source platform designed to simplify the lifecycle management of machine learning and deep learning projects. Polyaxon suffers from a container escape vulnerability that can be exploited by attackers to compromise the confidentiality, availability, and integrity of the system...
Vulnerability of the mtk_drm_bind() function in the drivers/gpu/drm/mediatek/mtk_drm_drv.c module – This driver provides support for Direct Rendering Infrastructure (DRI) in Mediatek graphics cards in Linux operating systems. It allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.
Vulnerability of the mtkdrmbind function in the drivers/gpu/drm/mediatek/mtkdrmdrv.c module – The DRI driver for Mediatek graphics cards in Linux operating systems relies on the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the...
Critical vulnerabilities in SICK DL100-2xxxxxxx
Critical vulnerabilities have been found in the SICK device DL100-2xxxxxxx. If exploited, this potentially allows an attacker to impact availabiltiy, integrity and confidentaility of the products. Currently, SICK is not aware of any public exploits specifically targeting these vulnerabilities. As...
CVE-2024-54085
AMI’s SPx contains a vulnerability in the BMC where an Attacker may bypass authentication remotely through the Redfish Host Interface. A successful exploitation of this vulnerability may lead to a loss of confidentiality, integrity, and/or availability...
CVE-2025-26661
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-26661 Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
Due to missing authorization check, SAP NetWeaver ABAP Class Builder allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high...
CVE-2025-25245 Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
SAP BusinessObjects Business Intelligence Platform Web Intelligence contains a deprecated web application endpoint that is not properly secured. An attacker could take advantage of this by injecting a malicious url in the data returned to the user. On successful exploitation, there could be a...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58045
Multi-concurrency vulnerability in the media digital copyright protection module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-51947
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-51945
There is a stored Cross-site Scripting vulnerability in ArcGIS Server for versions 11.3 and below that may allow a remote, authenticated attacker to create a stored crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. The privileges required...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2024-58048
Multi-thread problem vulnerability in the package management module Impact: Successful exploitation of this vulnerability may affect availability...