1925 matches found
CVE-2024-4078 Arbitrary Code Execution in parisneo/lollms
A vulnerability in the parisneo/lollms, specifically in the /unInstallbinding endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the name parameter in the unInstallbinding function, allowi...
CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...
CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...
SUSE SLED15: python-paramiko-doc / python-tqdm-bash-completion / etc (SUSE-SU-2024:1639-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1639-1 advisory. Changes in python-argcomplete - Update to 3.3.0 bsc1222880: Preserve compatibility with argparse...
RHEL 7 : python-py (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - python-py: ReDoS in the py.path.svnwc component via mailicious input to blame functionality CVE-2020-29651 Note tha...
FreeBSD : py-social-auth-app-django -- Improper Handling of Case Sensitivity (b3affee8-04d1-11ef-8928-901b0ef714d4)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b3affee8-04d1-11ef-8928-901b0ef714d4 advisory. - Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to...
GHSA-8P42-7597-P2F6 dcnnt-py is vulnerable to command injection via Notification Handler
A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotel...
dcnnt-py is vulnerable to command injection via Notification Handler
A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotel...
CVE-2023-1000
A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotel...
CVE-2023-1000 cyanomiko dcnnt-py Notification notifications.py main command injection
A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotel...
CVE-2023-1000
CVE-2023-1000 affects cyanomiko dcnnt-py up to 0.9.0, where the main function in dcnnt/plugins/notifications.py under Notification Handler permits remote command injection due to input handling weaknesses. Exploitation can be performed remotely, with impact described as command execution by an at...
CVE-2023-1000 cyanomiko dcnnt-py Notification notifications.py main command injection
A vulnerability was found in cyanomiko dcnnt-py up to 0.9.0. It has been classified as critical. Affected is the function main of the file dcnnt/plugins/notifications.py of the component Notification Handler. The manipulation leads to command injection. It is possible to launch the attack remotel...
FreeBSD : py-matrix-synapse -- weakness in auth chain indexing allows DoS (bdfa6c04-027a-11ef-9c21-901b0e9408dc)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bdfa6c04-027a-11ef-9c21-901b0e9408dc advisory. - Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a ro...
PT-2024-24362 · Kohya Ss · Kohya Ss
Name of the Vulnerable Software and Affected Versions: Kohya ss versions prior to 23.1.5 Description: Kohya ss is a GUI for Kohya's Stable Diffusion trainers. It is vulnerable to a path injection in the common gui.py add pre postfix function. Recommendations: For versions prior to 23.1.5, update ...
PT-2024-20651 · Openeuler · Aops-Zeus +1
Name of the Vulnerable Software and Affected Versions: openEuler aops-zeus versions 1.2.0 through 1.4.0 Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection', which allows Command Injection. This problem is...
MAL-2024-1108 Malicious code in mle-py-connector (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 91bb80bd9d7444d113ce05b2d2abac925c10e36a23ae955fd9ebd682cd046bd1 The OpenSSF Package Analysis project identified 'mle-py-connector' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...
Malicious code in mle-py-connector (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 91bb80bd9d7444d113ce05b2d2abac925c10e36a23ae955fd9ebd682cd046bd1 The OpenSSF Package Analysis project identified 'mle-py-connector' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...
Embedchain Security Breach
Embedchain is an open source RAG framework from Embedchain Open Source. A security vulnerability exists in Embedchain versions prior to 0.1.57. An attacker can exploit this vulnerability to execute arbitrary code related to the parameters of the openapi.py yaml.load function...
CVE-2024-21669
Hyperledger Aries Cloud Agent Python (ACA-Py) contains CVE-2024-21669: when verifying W3C JSON-LD Verifiable Credentials with Linked Data Proofs (LDP-VCs), the result of validating document.proof is not factored into the final presentation verification. This allows holders to present incorrectly ...