CVE-2024-20529 Cisco Identity Services Engine Arbitrary File Read and Delete Vulnerability

A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. To exploit this vulnerability, the attacker would need valid Super Admin credentials. This vulnerability is due to insufficient validation of user-suppli...

PT-2024-18676 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE versions prior to 3.3.0 Description: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. This is due to insufficient validation of...

RabbitMQ 访问控制错误漏洞

RabbitMQ is a feature-rich multi-protocol messaging and streaming agent open-sourced by RabbitMQ. An access control error vulnerability exists in RabbitMQ that stems from not validating a user's configure permissions when deleting a queue via the HTTP API. A user with valid credentials, partial...

Cisco Identity Services Engine 路径遍历漏洞

Cisco Identity Services Engine is an environment-aware platform from Cisco, USA. A path traversal vulnerability exists in Cisco Identity Services Engine that can be exploited by an attacker to read or delete arbitrary files...

PT-2024-8314 · Cisco · Cisco Ise

Name of the Vulnerable Software and Affected Versions: Cisco ISE affected versions not specified Description: A vulnerability in the API of Cisco ISE could allow an authenticated, remote attacker to read and delete arbitrary files on an affected device. The attacker would need valid Super Admin...

The vulnerability of the nilfs_btree_check_delete() function in the file system of the nilfs2 driver in the Linux operating system allows a attacker to compromise the confidentiality and accessibility of the protected information.

The vulnerability of the nilfsbtreecheckdelete function in the fs/nilfs2/btree.c file of the Linux operating system’s kernel involves accessing memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and accessibility of the...

GHSA-GHX4-CGXW-7H9P LocalAI Cross-site Scripting vulnerability

localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...

LocalAI Cross-site Scripting vulnerability

localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...

CVE-2024-48809

An issue in Open Networking Foundations sdran-in-a-box v.1.4.3 and onos-a1t v.0.2.3 allows a remote attacker to cause a denial of service via the onos-a1t component of the sdran-in-a-box, specifically the DeleteWatcher function...

GO-2024-3235 Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server

Mattermost server allows authenticated user to delete arbitrary post in github.com/mattermost/mattermost-server...

CVE-2024-45891

DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletewlanprofile...

CVE-2024-45882

DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the action parameter in cgi-bin/mainfunction.cgi is set to deletemapprofile...

SDRAN-in-a-Box 安全漏洞

SDRAN-in-a-Box RiaB is an SD-RAN cluster from the µONOS project capable of running within a single host. A security vulnerability exists in SDRAN-in-a-Box version v.1.4.3, which stems from a denial-of-service attack via the onos-a1t component of sdran-in-a-box specifically the DeleteWatcher...

LocalAI 安全漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A security vulnerability exists in LocalAI version 2.20.1, which stems from a call to the Delete Model API that causes stored cross-site scripting when passed inappropriate parameters...

PT-2024-31840 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection problem. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to delete wlan profile. Recommendations: For...

CVE-2024-48057

CVE-2024-48057 affects LocalAI (version

CVE-2024-48057

localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...

CVE-2024-48057

localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...

PT-2024-32972 · Localai +1 · Localai +1

Name of the Vulnerable Software and Affected Versions: localai versions =2.20.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability. When the delete model API is called with inappropriate parameters, it can cause a one-time storage XSS. This will trigger the payload when...

PT-2024-33235 · Open Networking Foundation · Onos-A1T +1

Name of the Vulnerable Software and Affected Versions: Open Networking Foundations sdran-in-a-box version 1.4.3 Open Networking Foundations onos-a1t version 0.2.3 Description: A denial of service issue allows a remote attacker to cause a disruption in service via the DeleteWatcher function in the...