121 matches found
CVE-2025-11046 Tencent WeKnora test testEmbeddingModel server-side request forgery
A security flaw has been discovered in Tencent WeKnora 0.1.0. This impacts the function testEmbeddingModel of the file /api/v1/initialization/embedding/test. The manipulation of the argument baseUrl results in server-side request forgery. The attack can be launched remotely. The exploit has been...
PT-2025-39691
Name of the Vulnerable Software and Affected Versions Tencent WeKnora version 0.1.0 Description A security flaw exists in Tencent WeKnora version 0.1.0. The testEmbeddingModel function within the /api/v1/initialization/embedding/test file is susceptible to server-side request forgery. Manipulatio...
axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL
Summary A previously reported issue in axios demonstrated that using protocol-relative URLs could lead to SSRF Server-Side Request Forgery. Reference: axios/axios6463 A similar problem that occurs when passing absolute URLs rather than protocol-relative URLs to axios has been identified. Even if...
MAL-2024-7608 Malicious code in sap-baseurl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 94e35034940640f4b3a25bc095af6e9194ed1465fd0ac61abc95de728a350b8b The OpenSSF Package Analysis project identified 'sap-baseurl' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
Malicious code in sap-baseurl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 94e35034940640f4b3a25bc095af6e9194ed1465fd0ac61abc95de728a350b8b The OpenSSF Package Analysis project identified 'sap-baseurl' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...
[SECURITY] [DLA 3486-1] ocsinventory-server update for php-cas
Debian LTS Advisory DLA-3486-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost July 08, 2023 https://wiki.debian.org/LTS Package : ocsinventory-server Version : 2.5+dfsg1-1+deb10u1 CVE ID : n/a Debian Bug : The source package ocsinventory-server, a Hardware and...
PT-2022-11659 · Webdetails · Webdetails Cpf
Name of the Vulnerable Software and Affected Versions: Webdetails cpf versions up to 9.5.0.0-80 Description: A vulnerability has been found in Webdetails cpf, where the manipulation of the baseUrl argument leads to cross-site scripting. This issue can be launched remotely. Recommendations: For...
Design/Logic Flaw
next-auth v3 users before version 3.29.2 are impacted. next-auth version 4 users before version 4.3.2 are also impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your callbacks option. If you already...
Leaked admin credentials via Insight object import
Affected versions of Atlassian Jira Service Management Server and Data Center allow authenticated users to see admin credentials via an information disclosure vulnerability in the \BaseUrl/rest/insight/1.0/import/module/test/rlabs-import-type-json?objectSchemaId= endpoint. The affected versions a...
The vulnerability of the app.support.baseURL configuration in the Mozilla Firefox browser allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the app.support.baseURL configuration in Mozilla Firefox browser lies in the lack of content sanitization in the URL string. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
Oracle Linux 7 : curl (ELSA-2019-1880)
The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1880 advisory. - CVE-2016-8615 cookie injection for other servers https://curl.haxx.se/docs/CVE-2016-8615.html - CVE-2016-8616 case insensitive password comparison...
Scientific Linux Security Update : curl on SL7.x x86_64 (20190729)
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes : - curl: NTLM password overflow via integer overflow CVE-2018-14618 For more details about the security issues, including t...
curl, libcurl security update
CentOS Errata and Security Advisory CESA-2019:1880 An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...
Low: Red Hat Security Advisory: curl security and bug fix update
An update for curl is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...
CVE-2018-5133
If the "app.support.baseURL" preference is changed by a malicious local program to contain HTML and script content, this content is not sanitized. It will be executed if a user loads "chrome://browser/content/preferences/in-content/preferences.xul" directly in a tab and executes a search. This...
CVE-2018-5133
CVE-2018-5133 affects Firefox before 59, where a malicious local program can set the app.support.baseURL preference to HTML/script, which is not sanitized and can execute when loading chrome://browser/content/preferences/in-content/preferences.xul or when an EME CDM-disabled notification is shown...
modeshutters.com.au XSS vulnerability
Vulnerable URL: http://modeshutters.com.au/svcore/full.html?bg="=http://modeshutters.com.au/gallery3/gallery.xml=http://modeshutters.com.au/gallery3/=http://modeshutters.com.au/gallery3/images/=http://modeshutters.com.au/gallery3/thumbs/=true=true=false=true=true=true=fff=fff=true=-1=Awnings...
Adobe Flash Player 8.0.34.0/9.0.x main.swf baseurl Parameter asfunction: Protocol Handler XSS
No description provided by source. source: http://www.securityfocus.com/bid/26949/info Adobe Flash Player is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code i...
Design/Logic Flaw
Insecure method vulnerability in the Web Scan Object ActiveX control OL2005.dll in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are...
CVE-2008-1116
Insecure method vulnerability in the Web Scan Object ActiveX control OL2005.dll in Rising Antivirus Online Scanner allows remote attackers to force the download and execution of arbitrary code by setting the BaseURL property and invoking the UpdateEngine method. NOTE: some of these details are...