Remote Code Execution via Pickle Deserialization with Hard-Coded AuthKey in RPC Server

Description RagFlow implements an RPC server using Python's native multiprocessing package. It fully understands the use of AuthKey to access and control the group communication when applying multiprocessing for network conditions via socket, but the current implementation hard-coded the AuthKey ...

curl: When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly

Vulnerability description not provided...

XSS through document upload

This report is not public...

Denial of service through sshfs-client in tracking server

This report is not public...

Running user provided regular expression, lead to DOS

This report is not public...

Unauthenticated Denial of Service (DoS) via Multipart Boundary in recent integration of Gradio UI

This report is not public...

Open Redirect

This report is not public...

Mars: Insecure API Response Leads to Disclosure of Hashed Passwords

A security vulnerability was identified in the API of ████████. The endpoint ████████ was found to return sensitive user information, including hashed passwords, in its response. This exposure presented a significant security risk, as it potentially allowed unauthorized access to user credentials...

AWS VDP: Reflected XSS on Amazon EC2 Instance

Product: Amazon Elastic Compute Cloud Amazon EC2 Vulnerability Type: Reflected Cross-Site Scripting XSS CVE: CVE-2022-29548 Severity: Medium Description: A reflected XSS vulnerability was discovered on the Amazon EC2 instance, allowing an attacker to inject malicious JavaScript code, potentially...

7z slip lead to remote code execution

This report is not public...

rar slip lead to remote code execution

This report is not public...

WordPress: Unauthenticated WordPress Database Repair DoS

Vulnerability description not provided...

AWS VDP: Information Disclosure Due To exposed .env file (Directory Listing) at ████████

Vulnerability description not provided...

Local File Inclusion in netease-youdao/qanything

This report is not public...

Redos (Regular Expression Denial of Service)

This report is not public...

server crash by zip bomb

This report is not public...

Linux Foundation Decentralized Trust: Memory Leak in bytes_to_hexstring Function

The function bytestohexstring was found to have a memory leak vulnerability. The function dynamically allocated memory using malloc but did not provide a way for the caller to free the allocated memory. This could lead to an increase in the program's memory consumption over time, potentially...

pickle deserialization vulnerability

Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...

Nextcloud: Exposing debug.log file leads to server full path disclosure

The debug.log file on the nextcloud.com website was publicly accessible and contained sensitive information, including the server's full directory path. This type of information disclosure could have assisted attackers in understanding the internal structure of the server...

U.S. Dept Of Defense: [ CVE-2018-1000129 ] RXSS At `https://███████` via the URI

The CVE-2018-1000129 vulnerability allowed remote cross-site scripting RXSS at the specified URL. The vulnerability was due to improper sanitization of user input, which enabled the execution of arbitrary scripts in the victim's browser...