CVE-2024-21029

Summary: CVE-2024-21029 affects Oracle E-Business Suite, Oracle Complex Maintenance, Repair, and Overhaul (LOV) in versions 12.2.3–12.2.13. It is an unauthenticated network-access vulnerability over HTTP that requires user interaction and can lead to unauthorized read/update/delete of data, with ...

CVE-2024-0549

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-0549 Relative Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-0549 Relative Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a default role account to delete files and folders within the filesystem, including critical database files such as 'anythingllm.db'. The vulnerability stems from insufficient input...

CVE-2024-0549

The CVE-2024-0549 entry concerns mintplex-labs/anything-llm and describes a relative path traversal in deletion requests. The root cause is insufficient input validation/normalization when handling file and folder deletion, allowing an authenticated default-role attacker to delete files (includin...

PT-2024-15649 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue allows unauthorized attackers with a default role account to perform a relative path traversal attack, enabling them to delete files and folders within the...

The vulnerability of the Apache Commons Compress library, related to executing a loop with an unreachable exit condition, allows attackers to compromise the integrity, accessibility, and confidentiality of the protected information.

The vulnerability of the Apache Commons Compress library is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to compromise the integrity, accessibility, and confidentiality of the protected information...

Security Bulletin: Improper integrity checking might affect IBM Storage Defender – Resiliency Service (CVE-2024-27261)

Summary IBM Storage Defender – Resiliency Service is vulnerable and that can result in data integrity issues. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2024-27261 DESCRIPTION: IBM Storage Defender - Resiliency Service could allow a privileged user to install a...

The vulnerability of the `flush_ref_samples()` function in the file `/gpac/src/isomedia/movie_fragments.c` of the multimedia platform GPAC allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the flushrefsamples function in the file /gpac/src/isomedia/moviefragments.c of the multimedia platform GPAC is related to the incorrect use of dynamic memory during program execution. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

The vulnerability of the extension of the Wikibase software for implementing the MediaWiki hypertext environment allows a perpetrator to compromise the integrity of the data.

The vulnerability of the extension of the Wikibase software for implementing the MediaWiki hypertext environment is related to the failure of the editing filters. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise confidentiality and affect the integrit...

The vulnerability of the decode_uncompressed_image() function, a decoder and file format encoder for the libheif library, allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the decodeuncompressedimage function, a decoder and file format encoder for the libheif library, is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

The vulnerability of the /libheif/exif.cc decoder and encoder for libheif files allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the /libheif/exif.cc decoder and file format encoder in the libheif library is related to a segmentation error. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Huawei HarmonyOS 安全漏洞

Huawei EMUI and Huawei HarmonyOS are both products of Huawei, a mobile operating system based on Android, and Huawei HarmonyOS, a distributed operating system developed by Huawei for the whole scenario, aiming at realizing intelligent interconnection and resource sharing among people, devices, an...

The vulnerability of the formSetCfm (/goform/setcfm) function in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetCfm /goform/setcfm function in the Tenda AC7 router software is caused by a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

The vulnerability of the formSetQosBand function (/goform/SetNetControlList) in the Tenda AC7 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetQosBand function /goform/SetNetControlList in the Tenda AC7 router software arises due to a buffer overflow in the stack. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected informatio...

Grafana: Users outside an organization can delete a snapshot with its key

Summary The DELETE /api/snapshots/key endpoint allows any Grafana user to delete snapshots if the user is NOT in the organization of the snapshot Details An attacker a user without organization affiliation or with a "no basic role" in an organization other than the one where the dashboard exists,...

The vulnerability of the Grafana monitoring and surveillance platform, related to bypassing authentication through spearphishing, allows attackers to gain unauthorized access to information and compromise its integrity and availability.

The vulnerability of the Grafana monitoring and observation platform is related to the escalation of privileges from the administrator to another administrator when using a authentication proxy server. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized...

The vulnerability of the autotools CARES_RANDOM_FILE component in the C-ares asynchronous DNS query library allows a attacker to compromise the integrity of the protected information.

The vulnerability of the CARESRANDOMFILE component in the C-ares asynchronous DNS query library is related to the use of rand as a backup mechanism. This allows attackers to exploit the absence of entropy, without using CSPRNG. Exploiting this vulnerability enables remote attackers to compromise...

undertow: Cookie Smuggling/Spoofing

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized da...

undertow: Cookie Smuggling/Spoofing

A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized da...