7892 matches found
PYSEC-2025-83
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
CVE-2024-8020
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
CVE-2024-7476
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....
CVE-2024-7476
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....
CVE-2024-8524
CVE-2024-8524 concerns modelscope/agentscope v0.0.4, where a directory traversal vulnerability allows an attacker to read arbitrary local JSON files via a crafted POST to the /read-examples endpoint. Affected component: agentscope (Python package) in the modelscope project; vulnerability arises f...
CVE-2024-8524 Directory Traversal in modelscope/agentscope
A directory traversal vulnerability exists in modelscope/agentscope version 0.0.4. An attacker can exploit this vulnerability to read any local JSON file by sending a crafted POST request to the /read-examples endpoint...
CVE-2024-7476 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....
CVE-2024-7476 Broken Access Control in lunary-ai/lunary
A broken access control vulnerability exists in lunary-ai/lunary versions 1.2.7 through 1.4.2. The vulnerability allows an authenticated attacker to modify any user's templates by sending a crafted HTTP POST request to the /v1/templates/id/versions endpoint. This issue is resolved in version 1.4....
CVE-2024-7476
The CVE-2024-7476 issue is a broken access control in lunary-ai/lunary versions 1.2.7 through 1.4.2. The root cause is improper access control on the /v1/templates/{id}/versions endpoint, which allows an authenticated attacker to modify any user’s templates by sending a crafted HTTP POST request....
CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning
A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...
CVE-2024-8020
CVE-2024-8020 (lightning-ai/pytorch-lightning, v2.3.2) exposes a DoS through an unexpected POST to the LightningApp API at /api/v1/state. The root cause is improper handling of unexpected state values, which can crash the server. Public references describe a DoS by sending crafted JSON (e.g., sta...
PT-2025-12205
Name of the Vulnerable Software and Affected Versions pytorch-lightning version 2.3.2 Description A vulnerability in pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occu...
CVE-2025-29217
CVE-2025-29217 affects Tenda W18E (v2.0, v16.01.0.11). A stack overflow in the wifiSSID parameter handled by /goform/setModules can be triggered by a crafted POST request, leading to Denial of Service. The connected sources (CNVD/CNNVD/RH/NVD/CVELIST) confirm the vulnerability details but do not ...
PT-2025-12185 · Lunary · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions 1.2.7 through 1.4.2 Description: A broken access control issue exists, allowing an authenticated attacker to modify any user's templates. This is achieved by sending a crafted HTTP POST request to the...
CVE-2025-27910
tianti v2.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request...
The vulnerability of the unserialize function in the Aspro content management platform allows attackers to execute arbitrary code. This vulnerability stems from defects in the deserialization mechanism.
The vulnerability of the unserialize function in the Aspro content management platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially crafted POST request...
D-Link DAP-1562 Null Pointer Dereference Vulnerability
The D-Link DAP-1562 is a wireless bridge from China's AUO D-Link. The D-Link DAP-1562 suffers from a null pointer dereference vulnerability, which originates from a null pointer dereference to parameter a1 in the HTTP POST Request Handler's function pureauthcheck, for which no detailed...
ABO.CMS 安全漏洞
ABO.CMS is a content management platform from ABO.CMS, Inc. A security vulnerability exists in ABO.CMS versions 5.8 through 5.9.3, which originates from a SQL injection attack sent to the TinyMCE module via an HTTP POST request...