The vulnerability of the CORS mechanism of the Vite application development local server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CORS mechanism of the Vite application development local server is related to the lack of origin verification in WebSockets. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information by sending specially craft...

CVE-2024-10289

This CVE affects LocalServer 1.0.9 and involves a Cross-Site Scripting (XSS) flaw in the /mlss/ManageSubscription endpoint, specifically exploiting the MSubListName parameter to potentially steal session details from authenticated users. The connected PT-2024-16161 entry confirms the vulnerabilit...

SUSE CVE-2024-47165

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

PYSEC-2024-196

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

Gradio 授权问题漏洞

Gradio, an open source Python library open-sourced by Hugging Face, is a method for demonstrating machine learning models through a friendly web interface. Gradio suffers from an Authorization Problem vulnerability that stems from an attacker's ability to make unauthorized requests to the local...

Server-Side Request Forgery

@nuxt/icon is vulnerable to Server-Side Request Forgery. The vulnerability is due to improperly parsed proxied request paths in the /api/nuxticon/name endpoint, which lets an attacker change the scheme and host of the request. An attackers can exploit this flaw by passing a path prefixed with...

CVE-2024-42352 Server-Side Request Forgery (SSRF) in nuxt-icon

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and...

Nuxt Icon affected by a Server-Side Request Forgery (SSRF)

Summary nuxt/icon provides an API to allow client side icon lookup. This endpoint is at /api/nuxticon/name. The proxied request path is improperly parsed, allowing an attacker to change the scheme and host of the request. This leads to SSRF, and could potentially lead to sensitive data exposure...

CVE-2024-34684

On Unix, SAP BusinessObjects Business Intelligence Platform Scheduling allows an authenticated attacker with administrator access on the local server to access the password of a local account. As a result, an attacker can obtain non-administrative user credentials, which will allow them to read o...

CVE-2024-34684

CVE-2024-34684 affects SAP BusinessObjects Business Intelligence Platform (Scheduling) on Unix. An authenticated attacker with local administrator access can access the password of a local account, enabling retrieval of non-administrative credentials and allowing read/modify of remote server file...

PT-2024-26104 · Sap · Sap Businessobjects Business Intelligence Platform

Name of the Vulnerable Software and Affected Versions: SAP BusinessObjects Business Intelligence Platform Scheduling affected versions not specified Description: The issue allows an authenticated attacker with administrator access on the local server to access the password of a local account. Thi...

CVE-2023-49234

An XML external entity XXE vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server...

CVE-2023-49234

An XML external entity XXE vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server...

CVE-2023-49234

An XML external entity XXE vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server...

CVE-2023-49234

Stilog Visual Planning 8 is affected by an XXE vulnerability. An authenticated attacker can exploit XML parser weaknesses to read arbitrary files on the application server and exfiltrate data to an external server. According to Schutzwerk, all versions prior to Visual Planning 8 (Build 240207) ar...

SUSE CVE-2024-1727

A Cross-Site Request Forgery CSRF vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the victim's server, an attacker can deplete...

My Cloud Multiple Products Code Issue Vulnerability

Western Digital My Cloud and others are products of Western Digital, Inc.Western Digital My Cloud is a personal cloud storage device.Western Digital My Cloud Home is an easy-to-use personal cloud storage device.Western Digital My Cloud Home Duo is an easy-to-use personal cloud storage...

Fedir Tsapana Simple HTTP Server PLUS Trust Management Issues Vulnerability

Fedir Tsapana Simple HTTP Server PLUS is an application from Fedir Tsapana that allows you to run small local HTTP servers with static content. A trust management issue vulnerability exists in Fedir Tsapana Simple HTTP Server PLUS version 1.8.1-plus and prior versions, which stems from the...

Directory traversal

The Wrangler command line tool email protected or email protected was affected by a directory traversal vulnerability when running a local development server for Pages wrangler pages dev command. This vulnerability enabled an attacker in the same network as the victim to connect to the local...

Cloudflare Wrangler Path Traversal Vulnerability

Cloudflare Wrangler is a repository from Cloudflare, Inc. A path traversal vulnerability exists in Wrangler versions prior to 3.1.1, which stems from a directory traversal vulnerability when running the local development server for Pages the wrangler Pages dev command, which can be exploited by a...