8578 matches found
Cross-site Request Forgery (CSRF)
Overview polyaxon is a Command Line Interface CLI and client to interact with Polyaxon API. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the create endpoint. An attacker who can convince a user to follow a malicious link can cause the creation of a...
PYSEC-2025-17
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user accou...
CVE-2025-0184
A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...
CVE-2025-1473
A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...
dify 代码问题漏洞
dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.2 of dify, which stems from the Create Knowledge section when uploading DOCX files is vulnerable to server-side request forgery attacks...
PT-2025-12301
Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.10.2 Description A Server-Side Request Forgery SSRF issue was identified in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested...
PT-2025-12233
Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 0.0.6a3 Description A vulnerability in the RpcAgentServerLauncher class allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the...
CVE-2025-0184: Server-Side Request Forgery (SSRF)
A Server-Side Request Forgery SSRF vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value is requested as a URL using the 'requests...
CVE-2025-29926
XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where the user could become an administrator and so performs other attacks on the farm. Note that this REST API is not bundled in XWiki Standard b...
kernel: net/mlx5e: fix a double-free in arfs_create_groups
A double-free vulnerability was found in the arfscreategroups function in the Linux kernel's net/mlx5e driver. This issue could lead to memory corruption or a system crash if exploited, as freeing the same memory twice may cause undefined behavior...
CVE-2025-2379
A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /create-pass.php. The manipulation of the argument visname leads to sql injection. The attack can be initiated remotely. The...
xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient()
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching...
Vulnerability of the siw_create_listen() function in the drivers/infiniband/sw/siw/siw_cm.c module – the Linux kernel’s InfiniBand support driver, which allows an attacker to compromise the confidentiality, integrity, and accessibility of protected information.
Vulnerability of the siwcreatelisten function in the drivers/infiniband/sw/siw/siwcm.c module – The Linux kernel’s InfiniBand support driver is vulnerable due to the repeated use of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...
PT-2025-11500
Name of the Vulnerable Software and Affected Versions PHPGurukul Apartment Visitors Management System version 1.0 Description A critical issue has been identified in the code of the /create-pass.php file. The manipulation of the visname argument leads to SQL injection. This issue can be exploited...
CVE-2025-25620
Unifiedtransform 2.0 is vulnerable to Cross Site Scripting XSS in the Create assignment function...
GHSA-3WGM-2GW2-VH5M Kubernetes GitRepo Volume Inadvertent Local Repository Access
A security vulnerability was discovered in Kubernetes that could allow a user with create pod permission to exploit gitRepo volumes to access local git repositories belonging to other pods on the same node. This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone...
PT-2025-14590
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to an integer overflow in the xp create and assign umem function. This occurs because the product of the i and pool-chunk size variables, both of type u32, can wrap...
PT-2025-16711
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A leak in the spufs create context function has been fixed. The issue was missed in previous leak fixes from 2008 and occurs when trying to set affinity and spufs mkdir fails, requiring ...
GHSA-G6WM-2V64-WQ36 LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection
Description The LocalS3 service's bucket creation endpoint is vulnerable to XML External Entity XXE injection. When processing the CreateBucketConfiguration XML document during bucket creation, the service's XML parser is configured to resolve external entities. This allows an attacker to declare...
