1312336 matches found
AWS VDP: CVE-2020-5902
CVE ID: CVE-2020-5902 Description: Affected Product: F5 BIG-IP Traffic Management User Interface TMUI Severity: Critical CVSS Score: 9.8 Description: Remote Code Execution RCE vulnerability in undisclosed pages of the TMUI CVE-2020-5902 is a critical vulnerability affecting the BIG-IP Traffic...
URL check not complete, lead to SSRF
This report is not public...
Denial of Service
This report is not public...
Web server DOS through run metrics
This report is not public...
Internet Bug Bounty: [CVE-2024-47888] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
There is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888. Carefully crafted text was found to cause the plaintextforblockquotenode helper to take an unexpected amount of time, possibly...
Improper Role Modification by Admins for Billing Permissions
Description Admins, who do not have direct permissions to access billing resources, are able to change the permissions of existing users to have billing permissions. This can lead to a privilege escalation scenario where an administrator can: 1. Change the role of an existing user to include...
Lack of access control on /users/me/org endpoint
Description The /users/me/org route is not adequately protected by access control mechanisms such as a middleware. This lack of authorization allows unauthorized users to access information about all team members in the current organization, even if the user does not have sufficient privileges. A...
Remote Code Execution via Pickle Deserialization with Hard-Coded AuthKey in RPC Server
Description RagFlow implements an RPC server using Python's native multiprocessing package. It fully understands the use of AuthKey to access and control the group communication when applying multiprocessing for network conditions via socket, but the current implementation hard-coded the AuthKey ...
curl: When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly
Vulnerability description not provided...
XSS through document upload
This report is not public...
Denial of service through sshfs-client in tracking server
This report is not public...
Running user provided regular expression, lead to DOS
This report is not public...
Unauthenticated Denial of Service (DoS) via Multipart Boundary in recent integration of Gradio UI
This report is not public...
Open Redirect
This report is not public...
Mars: Insecure API Response Leads to Disclosure of Hashed Passwords
A security vulnerability was identified in the API of ████████. The endpoint ████████ was found to return sensitive user information, including hashed passwords, in its response. This exposure presented a significant security risk, as it potentially allowed unauthorized access to user credentials...
AWS VDP: Reflected XSS on Amazon EC2 Instance
Product: Amazon Elastic Compute Cloud Amazon EC2 Vulnerability Type: Reflected Cross-Site Scripting XSS CVE: CVE-2022-29548 Severity: Medium Description: A reflected XSS vulnerability was discovered on the Amazon EC2 instance, allowing an attacker to inject malicious JavaScript code, potentially...
7z slip lead to remote code execution
This report is not public...
rar slip lead to remote code execution
This report is not public...