GHSA-73HC-M4HX-79PJ mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

Summary The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCPALLOWANONYMOUSACCESS=true is set required for the HTTP server to function without OAuth/API key,...

mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

Summary The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCPALLOWANONYMOUSACCESS=true is set required for the HTTP server to function without OAuth/API key,...

PT-2026-23609

Name of the Vulnerable Software and Affected Versions mcp-memory-service versions prior to 10.21.0 Description The /api/health/detailed endpoint in mcp-memory-service exposes sensitive system information, including OS version, Python version, CPU count, memory details, disk usage, and the full...

EUVD-2008-2857

Malware in sbrugna...

EUVD-2021-1346

Malware in sbrugna...

EUVD-2008-0149

Malware in sbrugna...

The vulnerability of the Q-Free MaxTime traffic light control software lies in improper restrictions on path names in the directory structure, allowing a violator to gain unauthorized access to protected information.

The vulnerability of the Q-Free MaxTime traffic light management software is related to an incorrect limitation on the path name for the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a...

The vulnerability of the Q-Free MaxTime traffic light control software lies in the improper limitation of the path name in the directory structure, allowing a violator to gain unauthorized access to protected information.

The vulnerability of the Q-Free MaxTime traffic light management software is related to an incorrect restriction on the path name for the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a...

The vulnerability of the Q-Free MaxTime traffic light control software lies in improper restrictions on path names in the directory structure. This allows a violator to gain unauthorized access to protected information and increase their privileges.

The vulnerability of the Q-Free MaxTime traffic light control software is related to an incorrect limitation on the path name for accessing the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information and enhan...

The vulnerability of the Q-Free MaxTime traffic light control software lies in the improper limitation of the path name in the directory structure, allowing a violator to gain unauthorized access to protected information.

The vulnerability of the Q-Free MaxTime traffic light management software is related to an incorrect restriction on the path name for the maxtime/api/database/database. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information through a...

CVE-2024-2360

parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path' settings. An attacker can exploit this vulnerability by manipulating these settings to execute...

CVE-2024-1873 Path Traversal and Denial of Service in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed /selectdatabase endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the DiscussionsDB instance. This flaw...

PT-2024-19956 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version latest Description: The issue is related to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path' and 'PDF LaTeX path'...

Lektor does not sanitize database path traversal

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is...

PYSEC-2024-49

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is...

CVE-2024-28335

Lektor before 3.3.11 does not sanitize DB path traversal. Thus, shell commands might be executed via a file that is added to the templates directory, if the victim's web browser accesses an untrusted website that uses JavaScript to send requests to localhost port 5000, and the web browser is...

PHP MySQL Admin Panel Generator 跨站脚本漏洞

PHP MySQL Admin Panel Generator is a PHP tool that helps you create PHP admin panels for any MySQL database in seconds. A security vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web script or HTML via a specially crafted payload injected in /edit-db.php...

CVE-2022-24883

FreeRDP is a free implementation of the Remote Desktop Protocol RDP. Prior to version 2.7.0, server side authentication against a SAM file might be successful for invalid credentials if the server has configured an invalid SAM file path. FreeRDP based clients are not affected. RDP server...

CVE-2021-39327

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible /dbbackuplog.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up t...

Centreon 操作系统命令注入漏洞

Centreon, a free and open source IT and application monitoring software, is vulnerable to an OS command injection vulnerability in /graphStatus/displayServiceStatus.php in Centreon version 19.10.8. A remote attacker can exploit this vulnerability to execute arbitrary OS commands via shell...