CVE-2024-11171 Improper Input Validation in danny-avila/librechat

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171

CVE-2024-11171 affects danny-avila/librechat (git 0c2a583). The vulnerability arises from improper input validation and the use of multer with in-memory storage, which has no file size limit, allowing an attacker to trigger out-of-memory conditions and a DoS. The issue is fixed in version 0.7.6. ...

CVE-2024-12065 Local File Inclusion in haotian-liu/llava

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component...

CVE-2024-12065

CVE-2024-12065 affects the haotian-liu/llava project (commit c121f04). The vulnerability is a local file inclusion caused by improper input validation in the Gradio-based web UI component, allowing an attacker to access arbitrary files on the server via crafted requests. The collection of connect...

CVE-2024-7773

CVE-2024-7773 is a duplicate of CVE-2024-45436. The vulnerability is a Zip Slip/path-traversal issue in Ollama prior to version 0.1.47, disclosed via Ollama’s extractFromZipFile logic. An attacker can craft ZIP archives with directory traversal (e.g., ../../../../etc/ld.so.preload) to write arbit...

CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2024-10361

The CVE-2024-10361 entry concerns a vulnerability in danny-avila/librechat v0.7.5-rc2 where the /api/files endpoint allows path traversal due to improper input validation, enabling arbitrary file deletion on the server. Affected component: the API files handling logic in LibreChat. Reported impac...

CVE-2024-10361 Arbitrary File Deletion via Path Traversal in danny-avila/librechat

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2025-1758

Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: LoadMaster: 7.2.40.0 and above ECS: All versions Multi-Tenancy: 7.1.35.4 and above...

CVE-2025-1758

Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: LoadMaster: 7.2.40.0 and above ECS: All versions Multi-Tenancy: 7.1.35.4 and above...

Progress LoadMaster 安全漏洞

Progress LoadMaster is a high performance Application Delivery Controller ADC and load balancer from Progress, Inc. A security vulnerability exists in Progress LoadMaster that stems from improper input validation and could result in a buffer overflow...

ROS-20250319-02

A vulnerability in the dm cache component of the Linux operating system kernel is related to a read error outside the bounds in the canresize function in drivers/md/dm-cache-target.c. Exploitation of the vulnerability could allow an an attacker to cause a denial of service Vulnerability in the...

VulnCheck KEV: CVE-2024-47374

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through = 6.5.0.2...

Cross-Site Scripting (XSS)

org.apache.felix, org.apache.felix.http.webconsoleplugin is vulnerable to cross-site scripting XSS. The vulnerability is due to improper neutralization of user input during web page generation, allowing an attacker to inject and execute malicious scripts in a victim’s browser through improperly...

K000150431: Multiple Intel UEFI firmware vulnerabilities

Security Advisory Description CVE-2023-34440 Improper input validation in UEFI firmware for some IntelR Processors may allow a privileged user to potentially enable escalation of privilege via local access. CVE-2023-43758 Improper input validation in UEFI firmware for some IntelR processors may...

CVE-2025-26556 WordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in zzmaster WP AntiDDOS allows Reflected XSS. This issue affects WP AntiDDOS: from n/a through 2.0...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 291 Vulnerability Details CVEID:CVE-2025-25193 DESCRIPTION: Netty, an asynchronous, event-driven network application framework, has a vulnerability in versions up to and...

WordPress plugin m1.DownloadList 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-26006

An improper neutralization of input during web page Generation vulnerability CWE-79 in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote...