Uptime Kuma 路径遍历漏洞

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. A path traversal vulnerability exists in Uptime Kuma versions 1.23.0 through 1.23.15 and 2.0.0-beta.0, which stems from a lack of server-side validation and cleanup stemming from a URL field in the...

@volpe/astro-utils (>=0.0.1 <=0.0.20), astro-npm-loader (>=0.0.1 <=0.1.2) potentially affected by CVE-2024-56159 via astro (=5.0.0-beta.5)

astro NPM version =5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: OSV:GHSA-49W6-73CW-CHJR...

CVE-2024-12478

InvoicePlane 1.x is affected up to 1.6.1 by CVE-2024-12478 due to unrestricted upload via the upload_file function at /index.php/upload/upload_file/1/1. The issue allows remote abuse of the file parameter to upload arbitrary content. A fixed version is 1.6.2-beta-1; upgrading addresses the vulner...

PT-2024-17708 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane versions up to 1.6.1 Description: A vulnerability was found in InvoicePlane, affecting some unknown functionality of the file /invoices/view. The manipulation leads to session expiration. The attack may be launched remotely, with...

PT-2024-17570 · Unknown · Invoiceplane

Name of the Vulnerable Software and Affected Versions: InvoicePlane versions up to 1.6.1 Description: A vulnerability was found in InvoicePlane, affecting the function download of the file invoices.php. The manipulation of the invoice argument leads to path traversal. It is possible to initiate t...

actix-session-surrealdb (>=0.1.0 <=0.1.5) potentially affected by unknown CVE via surrealdb (=1.0.0-beta.9)

surrealdb CARGO version =1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: OSV:GHSA-M52V-24P8-654F...

PT-2024-41125 · Git · V8

Outdated dependency on V8 found see policy. Please update to the latest beta, stable, or extended stable versions...

PT-2025-21163

Name of the Vulnerable Software and Affected Versions: Netgate pfSense CE versions prior to 2.8.0 beta release Netgate pfSense CE corresponding Plus builds versions prior to 2.8.0 beta release Description: The issue allows remote attackers to execute arbitrary JavaScript, delete backups, or leak...

CVE-2024-52372

Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through = 7.0.0...

CVE-2024-52372 WordPress Easy CSV Importer plugin <= 7.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WebTechGlobal Easy CSV Importer BETA easy-csv-importer allows Upload a Web Shell to a Web Server.This issue affects Easy CSV Importer BETA: from n/a through = 7.0.0...

WordPress plugin Easy CSV Importer BETA 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists in...

PT-2024-35209 · Webtechglobal · Webtechglobal Easy Csv Importer

Name of the Vulnerable Software and Affected Versions: WebTechGlobal Easy CSV Importer BETA versions n/a through 7.0.0 Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling the upload of a web shell to a web server. This poses a significant...

Digistar AG-30 Plus 安全漏洞

Digistar AG-30 Plus is an access gateway from Digistar that integrates a specialized router to allow communication between IP and digital technologies in a simple and secure manner. A security vulnerability exists in Digistar AG-30 Plus version 2.6b that stems from an improper restriction of...

Race Condition

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Race Condition due to improper isolation in functions updaterootinconfig and route handlers that access and modify blocks.config. Attackers can explo...

CVE-2024-47881

OpenRefine is a free, open source tool for working with messy data. Starting in version 3.4-beta and prior to version 3.8.3, in the database extension, the "enableloadextension" property can be set for the SQLite integration, enabling an attacker to load local or remote extension DLLs and so run...

CVE-2024-49366

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of ../../. Arbitrary files can be written to the server, which may result in loss of permissions...

CVE-2024-49368

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue...

CVE-2024-49367 Nginx UI's log path can be controlled

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at /api/configs to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue...

CVE-2024-49367 Nginx UI's log path can be controlled

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at /api/configs to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue...

CVE-2024-49367 Nginx UI's log path can be controlled

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at /api/configs to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue...