231579 matches found
CVE-2024-3028
CVE-2024-3028 affects mintplex-labs/anything-llm. The issue is improper input validation in the system-preferences API where manipulating the logo_filename parameter can cause reading of arbitrary files (including .env) and deletion via remove-logo. Root cause: lack of proper sanitization of user...
CVE-2024-1593
This CVE describes a path traversal vulnerability in the mlflow/mlflow repository caused by improper handling of URL parameters. Attackers can smuggle path traversal sequences using the ';' character in URLs to manipulate the 'params' portion and access unauthorized files or directories. The repo...
CVE-2024-3573
The CVE-2024-3573 entry concerns mlflow/mlflow with a Local File Inclusion (LFI) caused by improper parsing of URIs in the is_local_uri logic. The issue misclassifies URIs with empty or file schemes as non-local, enabling an attacker to craft malicious model versions (source parameter) that bypas...
CVE-2024-1626
CVE-2024-1626 affects lunary-ai/lunary (version 0.3.0). Affected component: project update endpoint /v1/projects/:projectId. Root cause: insufficient authorization checks allow authenticated users to modify any project’s name by referencing a projectId not owned by them, enabling cross-organizati...
CVE-2024-3575
MindsDB (mindsdb/mindsdb) has a stored XSS vulnerability via CSV uploads. The root cause is insufficient sanitization/escaping of user-supplied CSV content, allowing JavaScript payloads that execute when the file is viewed in the web UI. Affected scope includes both cloud and OSS deployments per ...
CVE-2024-1666
CVE-2024-1666 affects lunary-ai/lunary 1.0.0, where an authorization flaw allows unauthorized radar creation. The root cause is missing server-side checks to verify a user’s paid/upgraded status during radar creation (enforced only in the web UI). Attackers can bypass account upgrade requirements...
CVE-2024-29402
CVE-2024-29402 affects cskefu v7 and is caused by Insufficient Session Expiration, enabling an attacker to exploit an old session for malicious activity. Original and connected sources (NVD, Red Hat, CVE list, CNNVD, PTSecurity) confirm the vulnerability and its basic impact profile: CVSS v3.1 ba...
CVE-2024-32254
CVE-2024-32254 affects Phpgurukul Tourism Management System v2.0. The vulnerability is an unrestricted upload of a file with a dangerous type via the endpoint tms/admin/create-package.php, caused by missing validation on uploaded images. Reported impact is high (data integrity/confidentiality/ava...
CVE-2024-31680
CVE-2024-31680 affects Shibang Communications Co., Ltd. IP network intercom broadcasting system version 1.0. The vulnerability is a file upload flaw in the my_parser.php component, enabling a local attacker to execute arbitrary code. The available documents consistently describe this risk as a lo...
CVE-2024-27794
CVE-2024-27794 affects Claris FileMaker Server versions prior to 20.3.2. The issue is a reflected Cross-Site Scripting vulnerability caused by an improperly handled parameter in the FileMaker WebDirect login endpoint. The impact is a potential XSS via the login flow; the fix is to upgrade to File...
CVE-2024-32035
The CVE-2024-32035 entry concerns SixLabors.ImageSharp, a 2D graphics API. The vulnerability causes excessive memory usage in image decoders when processing specially crafted files, enabling a denial of service (DoS) by exhausting process memory. Affected is the ImageSharp decoding path as descri...
CVE-2024-23594
Technical details about CVE-2024-23594 (affected product/component/impact) are not provided in the connected documents. Monitor for updates from Lenovo or security advisories.
CVE-2023-48709
CVE-2023-48709 – iTop formula/CSV export vulnerability : Combodo iTop exports data to CSV/Excel; inputs in exported files may contain malicious formulas. If opened in Excel, this could lead to remote code execution (noted for Excel 2016). Affected versions are iTop prior to the fixed releases. Re...
CVE-2024-23559
CVE-2024-23559 affects HCL DevOps Deploy / Launch, where the product generates an obsolete HTTP header. The entry is supported by multiple sources (NVD, CVE records, and vendor advisories) indicating a configuration/implementation issue in the HTTP header handling, with a CVSS v3.1 base score of ...
CVE-2023-45808
CVE-2023-45808 – iTop silo check bypass Affected software: Combodo iTop (IT service management platform). Issue: When creating or updating objects, extkey values aren’t checked against the current user silo, allowing forged HTTP requests to reference out-of-silo objects (e.g., a UserRequest in an...
CVE-2024-3797
CVE-2024-3797 affects SourceCodester QR Code Bookmark System 1.0. The issue is an SQL injection in the /endpoint/delete-bookmark.php?bookmark=1 parameter, enabling remote attacker execution via the bookmark argument. There is public disclosure of the exploit. Affected component is the delete-book...
CVE-2024-3794
CVE-2024-3794 affects WBSAirback 21.02.04 with a stored XSS vulnerability in the /admin/AdvancedSystem endpoint (description field, all parameters). The issue could allow a remote attacker to craft a URL to steal session data. No patch/version details are provided in the documents; a PT-2024-2784...
CVE-2024-3783
WBSAirback 21.02.04 Backup Agents contains a path traversal vulnerability that a low-privilege user can exploit to download files from the system. Affected component: path handling in WBSAirback; impact is confidentiality breach. No remediation details are provided in the supplied documents.
CVE-2024-24898
The CVE-2024-24898 issue affects openEuler kernel versions 4.19.90-2109.1.0.0108 through before 4.19.90-2403.4.0.0244. Root cause is related to the tcm.C file in drivers/staging/gmjstcm, leading to Exposure of Sensitive Information to an Unauthorized Actor (Resource Leak Exposure). Remediation pe...