Authentication Bypass Using Pre-signed URLs - ownCloud

Improper validation may allow an attacker to bypass authentication and gain access to users’ files. Prior knowledge of a username and a file path is needed in order to gain access to a certain file...

Improper Validation in the User Profile Metadata - ownCloud

Improper Validation in the User Profile Metadata may allow an authenticated attacker to edit their own profile in a way that consumes a substantial amount of resources, creating a Denial of Service...

Path Traversal

langchain is vulnerable to Path Traversal. The vulnerability is due to improper pathname validation in the LocalFileStore functionality, which allows an attacker to read or write files anywhere on the filesystem...

PT-2024-4521 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: FFmpeg version n6.1 Description: The issue is related to an improper validation of array index in the libavcodec/cbs h266 syntax template.c file of the FFmpeg library. This allows attackers to cause undefined behavior within the application...

CVE-2024-31581

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbsh266syntaxtemplate.c. This vulnerability allows attackers to cause undefined behavior within the application...

CVE-2024-31581

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbsh266syntaxtemplate.c. This vulnerability allows attackers to cause undefined behavior within the application...

CVE-2024-31581: Improper Validation of Array Index

FFmpeg version n6.1 was discovered to contain an improper validation of array index vulnerability in libavcodec/cbsh266syntaxtemplate.c. This vulnerability allows attackers to cause undefined behavior within the application...

CVE-2024-31581

FFmpeg version n6.1 contains an improper validation of array index vulnerability in the libavcodec/cbs_h266_syntax_template.c component. This flaw allows attackers to trigger undefined behavior within the application. While specific exploitation details are not provided in the documents, external...

mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

CVE-2024-1739

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the cas...

CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow

A path traversal vulnerability exists in the createmodelversion function within server/handlers.py of the mlflow/mlflow repository, due to improper validation of the source parameter. Attackers can exploit this vulnerability by crafting a source parameter that bypasses the...

CVE-2024-1739: Incorrect Synchronization

lunary-ai/lunary is vulnerable to an authentication issue due to improper validation of email addresses during the signup process. Specifically, the server fails to treat email addresses as case insensitive, allowing the creation of multiple accounts with the same email address by varying the cas...

Sensitive Information Disclosure

Azure.Identity is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper validation of user-supplied input, allowing an attacker to access sensitive information...

Remote Code Execution (RCE)

mysql2 is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of supportBigNumbers and bigNumberStrings values within the readCodeFor function, which allows an attacker to execute arbitrary code...

CVE-2024-30395

An Improper Validation of Specified Type of Input vulnerability in Routing Protocol Daemon RPD of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause Denial of Service DoS. If a BGP update is received over an established BGP session which contains a tunnel...

CVE-2024-30395 Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash

An Improper Validation of Specified Type of Input vulnerability in Routing Protocol Daemon RPD of Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause Denial of Service DoS. If a BGP update is received over an established BGP session which contains a tunnel...

CVE-2024-30395

CVE-2024-30395 describes an improper validation of a BGP tunnel encapsulation attribute in Junos OS and Junos OS Evolved RPD, leading to an unauthenticated, network-based DoS. A BGP update containing a specifically malformed TLV can cause Routing Protocol Daemon (rpd) to crash and restart. Affect...

CVE-2024-21598

CVE-2024-21598 affects Juniper Networks Junos OS and Junos OS Evolved, where the Routing Protocol Daemon (rpd) crashes and restarts when receiving a BGP update containing a malformed TLV in a tunnel encapsulation attribute. This is due to improper validation of syntactic correctness of input. Imp...

Local File Inclusion (LFI)

gradio is vulnerable to a Local File Inclusion. This vulnerability is due to improper validation of user-supplied input in the UploadButton component, specifically in the handling of file paths during file uploads to the /queue/join endpoint, which allows attackers to read arbitrary files on the...

Cisco IOS XE Software OSPFv2 DoS (cisco-sa-iosxe-ospf-dos-dR9Sfrxp)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in the OSPF version 2 OSPFv2 feature of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial...