CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking

trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. Prior to commit d4fa66f49cedab449af9a56a21ab40697b9f7b97, the trunk sessions verification step could be manipulated for owner session hijacking Compromising a victim’s session will result in a full takeover of...

BIT-HUBBLE-UI-2023-27595

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. In version 1.13.0, when Cilium is started, there is a short period when Cilium eBPF programs are not attached to the host. During this period, the host does not implement any of Cilium's featureset. This ca...

Exploit for Improper Restriction of XML External Entity Reference in Adobe Commerce

CosmicSting: critical unauthenticated XXE vulnerability in Ado...

The vulnerability of the Collection Preview component of the edu-sharing e-learning platform management system allows a perpetrator to execute arbitrary code or trigger a service failure.

The vulnerability of the Collection Preview component in the edu-sharing e-learning platform management system involves unlimited downloading of dangerous files. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code using a specially created HTML file, or to...

PT-2024-5209 · Cocoapods · Cocoapods

Name of the Vulnerable Software and Affected Versions: CocoaPods affected versions not specified Description: The issue is related to the authentication server for the CocoaPods dependency manager, where the trunk sessions verification step could be manipulated, allowing for owner session...

The vulnerability of the microprogrammed software of the industrial cellular LTE modem OnCell G3470A-LTE, related to buffer overflow in the stack, allows a hacker to trigger a service failure.

The vulnerability of the microprogrammed software in the OnCell G3470A-LTE industrial cellular LTE modem is related to buffer overflow in the stack. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2024-5712 CSRF Vulnerability in stitionai/devika

A Cross-Site Request Forgery CSRF vulnerability was identified in the stitionai/devika application, affecting the latest version. This vulnerability allows attackers to perform unauthorized actions in the context of a victim's browser, such as deleting projects or changing application settings,...

The vulnerability of the Delete component in the cloud software for creating and using Nextcloud Server’s data storage allows a attacker to cause a service failure.

The vulnerability of the “Delete” component in the cloud software for creating and using data storage for Nextcloud Server is related to lack of access control. Exploiting this vulnerability could allow an attacker to cause service interruptions...

The vulnerability of the ExtractImageSection() function in the LibTIFF library, which allows a hacker to cause a service failure.

The vulnerability of the ExtractImageSection function in the LibTIFF library is related to the copying of buffers without checking the input size. Exploiting this vulnerability could allow an attacker to cause a service failure using the created Tiff file...

The vulnerability of the NVIDIA Virtual GPU Manager driver, which allows a hacker to elevate their privileges or cause service interruptions.

The vulnerability of the NVIDIA Virtual GPU Manager driver relates to the improper assignment of privileges. Exploiting this vulnerability allows an attacker to enhance their privileges or cause service interruptions...

CVE-2024-5935

A Cross-Site Request Forgery CSRF vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users...

CVE-2024-5935 CSRF Vulnerability in imartinez/privategpt

A Cross-Site Request Forgery CSRF vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users...

CVE-2024-5935 CSRF Vulnerability in imartinez/privategpt

A Cross-Site Request Forgery CSRF vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users...

CVE-2024-5935 CSRF Vulnerability in imartinez/privategpt

A Cross-Site Request Forgery CSRF vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete all uploaded files on the server. This can lead to data loss and service disruption for the application's users...

CVE-2024-5935

CVE-2024-5935 describes a CSRF vulnerability in imartinez/privategpt version 0.5.0 that lets an attacker delete all uploaded files on the server, causing data loss and service disruption for users. The issue stems from a CSRF flaw affecting the file-deletion functionality. Public details across m...

PrivateGPT Cross-Site Request Forgery Vulnerability

PrivateGPT is an AI project. A cross-site request forgery vulnerability exists in PrivateGPT version 0.5.0, which stems from a vulnerability that allows an attacker to delete all uploaded files on the server, which could result in data loss and service interruption for application users...

PT-2024-37250 · Imartinez · Privategpt

Name of the Vulnerable Software and Affected Versions: imartinez/privategpt version 0.5.0 Description: A Cross-Site Request Forgery CSRF issue allows an attacker to delete all uploaded files on the server, leading to data loss and service disruption for the application's users. Recommendations: F...

Chinese Espionage Group “ChamelGang” Uses Attacks for Disruption and Data Theft

Beware! Chinese cyberespionage group ChamelGang targets critical infrastructure like aviation and government systems. SentinelOne report reveals potential attacks across Asia. Learn more about ChamelGang's cyberespionage activities...

The vulnerability of the CI/CD pipeline editor of a Git-based software platform for collaborative code development on GitLab allows a hacker to trigger a service failure.

The vulnerability of the CI/CD pipeline editor of a Git-based software platform for collaborative code development on GitLab is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a malicious actor to cause service interruptions using specially created malware...

The vulnerability of the Asana software platform’s Git-based collaborative coding tool allows a hacker to trigger a service failure.

The vulnerability of the Asana software platform, which is based on Git for collaborative code development on GitLab, involves an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to trigger service interruptions through specially created requests...