PT-2024-23313 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is due to improper input validation, allowing attackers to read and delete arbitrary files on the server. By manipulating the logo filename parameter in the...

Rockwell Automation 5015-AENFTXT 安全漏洞

Rockwell Automation 5015-AENFTXT is a hardware device from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation 5015-AENFTXT version v35 that stems from the presence of an improper input validation vulnerability...

(Pwn2Own) Google Chrome WASM Improper Input Validation Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Google Chrome. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the implementation o...

The vulnerability of the Jenkins Red Hat Dependency Analytics plugin, related to improper input handling during the creation of web pages, allows attackers to execute XSS attacks with control over files in the working areas.

The vulnerability of the Jenkins Red Hat Dependency Analytics plugin is related to the lack of Content-Security-Policy protection for user-generated content in working areas, archived artifacts, etc., which Jenkins provides for loading. Exploiting this vulnerability allows a malicious actor to...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400 import os,base64,time systempth = "/usr/lib/...

Siemens Scalance W1750D Improper Input Validation (CVE-2023-45627)

An authenticated Denial-of-Service DoS vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected access point. This plugin only works with Tenable.ot. Please visit...

Siemens Scalance W1750D Improper Input Validation (CVE-2023-45620)

Unauthenticated Denial-of-Service DoS vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point. This plugin only works with Tenable.ot. Please visi...

Siemens Scalance W1750D Improper Input Validation (CVE-2023-45621)

Unauthenticated Denial-of-Service DoS vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabilities result in the ability to interrupt the normal operation of the affected access point. This plugin only works with Tenable.ot. Please visi...

CVE-2024-21590

An Improper Input Validation vulnerability in Juniper Tunnel Driver jtd and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attacker within the MPLS administrative domain to send specifically crafted packets to the Routing Engine RE to cause a Denial of Service DoS. Whe...

CVE-2024-21590 Junos OS Evolved: Packets which are not destined to the device can reach the RE

An Improper Input Validation vulnerability in Juniper Tunnel Driver jtd and ICMP module of Juniper Networks Junos OS Evolved allows an unauthenticated attacker within the MPLS administrative domain to send specifically crafted packets to the Routing Engine RE to cause a Denial of Service DoS. Whe...

CVE-2024-21590

CVE-2024-21590 describes an improper input validation in Juniper Tunnel Driver (jtd) and the ICMP module of Junos OS Evolved that allows an unauthenticated attacker within the MPLS domain to send crafted MPLS IPv4 packets to the Routing Engine, potentially causing a Denial of Service (DoS). Affec...

Mageia: Security Advisory (MGASA-2024-0116)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-24292 · Polevaultweb · Polevaultweb Intagrate Lite

Name of the Vulnerable Software and Affected Versions: Polevaultweb Intagrate Lite versions 1.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations:...

PT-2024-24301 · Twipla · Twipla

Name of the Vulnerable Software and Affected Versions: TWIPLA Visitor Analytics IO versions 1.2.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2024-24288 · Unknown · Faktor Vier F4 Improvements

Name of the Vulnerable Software and Affected Versions: FAKTOR VIER F4 Improvements versions 1.8.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

CVE-2024-3570

A stored Cross-Site Scripting XSS vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to...

CVE-2024-3570 Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm

A stored Cross-Site Scripting XSS vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to...

CVE-2024-3570

The CVE-2024-3570 entry affects the chat functionality of mintplex-labs/anything-llm. It describes a stored XSS flaw where user and ChatBot input are not properly sanitized, specifically via dangerouslySetInnerHTML, allowing attackers to execute arbitrary JavaScript in a user’s session. Impacted ...

CVE-2024-3101 Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multiusermode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This acti...

CVE-2024-3101 Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multiusermode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This acti...