CVE-2024-10096

A flaw was found in the Dask Distributed Server. This vulnerability allows remote code execution via pickle serialization, enabling attackers to craft and send malicious objects for deserialization on the server. Mitigation Mitigation for this issue is either not available or the currently...

CVE-2024-12911

A flaw was found in the run-llama/llamaindex repository. This vulnerability allows arbitrary file creation and denial of service DoS attacks via SQL injection through prompt injection. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2024-6866

A flaw was found in flask-cors. This vulnerability allows unauthorized origins to access restricted paths, leading to potential data exposure and leaks via case-insensitive request path matching due to improper use of the trymatch function. Mitigation Mitigation for this issue is either not...

CVE-2024-6844

A flaw was found in Flask-CORS. This vulnerability allows unauthorized cross-origin access or improper request blocking via incorrect handling of the '+' character in URL paths, leading to an inconsistent CORS policy application. Mitigation Mitigation for this issue is either not available or the...

CVE-2024-6839

A flaw was found inflask-cors. This vulnerability allows unauthorized cross-origin access to sensitive data or functionality via improper regex path matching, prioritizing longer patterns over more specific ones. This issue leads to less restrictive CORS policies being applied to sensitive...

PYSEC-2025-92

An unauthenticated Denial of Service DoS vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups...

Detecting and Mitigating Apache Tomcat CVE-2025-24813

...

SMA Sunny Portal

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to upload and remotely execute code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all...

PT-2025-12237

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 21161fe Description A stored cross-site scripting XSS issue exists in the view for inspecting detailed run information. This occurs because a user-controllable string, the run ID, is appended and rendered as HTML,...

PT-2025-12203 · Unknown · Imartinez/Privategpt

Name of the Vulnerable Software and Affected Versions: imartinez/privategpt version 0.5.0 Description: A Denial of Service DOS attack can be performed by appending a large number of characters to the end of a multipart boundary when uploading a file. This leads to uncontrolled resource consumptio...

Critical Veeam Backup & Replication CVE-2025-23120

Update Friday, March 28, 2025: Security researchers at CODE WHITE GmbH have noted on social media that it is possible to bypass the patch for CVE-2025-23120. Rapid7 has not directly confirmed the patch bypass, but we are relatively confident in the validity of the finding. Customers should ensure...

CVE-2025-29770

A flaw was found in vLLM. This vulnerability can allow Denial of Service via filesystem exhaustion. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicabilit...

PT-2025-12331

Apache Druid and Affected Versions Apache Druid versions prior to 31.0.2 and prior to 32.0.1 Description Apache Druid is susceptible to Server-Side Request Forgery SSRF, Cross-Site Scripting XSS, and Open Redirect issues. When the Druid management proxy is used, a specially crafted URL in a reque...

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004

Drupal core Link field attributes are not sufficiently sanitized, which can lead to a Cross Site Scripting vulnerability XSS. This vulnerability is mitigated by that fact that an attacker would need to have the ability to add specific attributes to a Link field, which typically requires edit acce...

CVE-2024-40635

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as roo...

CVE-2025-2487

A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it...

Apache Tomcat Remote Code Execution / Information Disclosure

This is the formal advisory from Apache regarding the recent partial PUT vulnerability that allows for potential remote code execution or information disclosure. Apache Tomcat versions 11.0.0-M1 to 11.0.2, 10.1.0-M1 to 10.1.34, and 9.0.0.M1 to 9.0.98 are affected. CVE-2025-24813 Potential RCE...

CVE-2023-22512

This High severity DoS Denial of Service vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. With a CVSS Score of 7.5, this vulnerability allows an unauthenticated attacker to cause a resource to be unavailable for its intended users by temporarily or indefinitely...

CVE-2025-27512

A flaw was found in Zincati, an auto-update agent for Fedora CoreOS hosts. This vulnerability may allow an unprivileged user with access to the system D-Bus socket to deploy older Fedora CoreOS versions, which may have other known vulnerabilities, and reboot the system into the deployed update vi...

Creating Scripts to Identify Vulnerable Proxy Servers

This whitepaper covers how to create Nmap scripts to identify banners and versions of proxy servers. It also covers methods to mitigate the public visibility of banners and version information on proxy servers. Written in Portuguese...