EUVD-2021-26228

Malware in sbrugna...

EUVD-2018-5289

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2022-24829

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some...

Linux Distros Unpatched Vulnerability : CVE-2019-2993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: C API. Supported versions that are affected are 5.7.27 and prior and 8.0.17 and...

Python A2A 路径遍历漏洞

Python A2A is a functional Python library by the individual developer Manoj Desai for implementing Google's A2A protocol. A security vulnerability exists in Python A2A version 0.5.5 and earlier, which stems from a path traversal issue in the function createworkflow in the file...

CVE-2024-3317

An improper access control was identified in the Identity Security Cloud ISC message server API that allowed an authenticated user to exfiltrate job processing metadata opaque messageIDs, work queue depth and counts for other tenants...

CVE-2021-21396

wire-server is an open-source back end for Wire, a secure collaboration platform. In wire-server from version 2021-02-16 and before version 2021-03-02, the client metadata of all users was exposed in the GET /users/list-clients endpoint. The endpoint could be used by any logged in user who could...

CVE-2024-48907

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...

CVE-2024-48907

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...

CVE-2024-48907

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...

CVE-2024-48907

Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API...

CVE-2024-48907

The CVE-2024-48907 reference concerns Sematell ReplyOne version 7.4.3.0 that is susceptible to Server-Side Request Forgery (SSRF) through the application server API. The available sources describe the vulnerability as enabling the application server to initiate unauthorized external requests, wit...

Arbitrary File Deletion

Aim is vulnerable to Arbitrary File Deletion. The vulnerability is due to path traversal due to improper normalization of the runhash parameter in the LockManager.releaselocks function, allowing attackers to delete arbitrary files via the tracking server API...

Aim path traversal in LockManager.release_locks

A vulnerability in the LockManager.releaselocks function in aimhubio/aim commit bb76afe allows for arbitrary file deletion through relative path traversal. The runhash parameter, which is user-controllable, is concatenated without normalization as part of a path used to specify file deletion. Thi...

CVE-2025-27364

MITRE Caldera vulnerability CVE-2025-27364 affects Caldera server in versions up to 4.2.0 and 5.0.0 prior to the commit 35bc06e. It is a Remote Code Execution (RCE) in the server’s dynamic agent (implant) compilation feature, allowing a remote attacker to run arbitrary code on the Caldera host vi...

CVE-2024-7340

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin...

CVE-2024-53007

Bentley Systems ProjectWise Integration Server before 10.00.03.288 allows unintended SQL query execution by an authenticated user via an API call...

CVE-2025-21611

tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to most, but not all, authorized actions...

GHSA-66R2-XM28-74W9 Composio Path Traversal vulnerability

A vulnerability was found in composiohq composio up to 0.5.8 and classified as problematic. Affected by this issue is the function path of the file composio\server\api.py. The manipulation of the argument file leads to path traversal. The exploit has been disclosed to the public and may be used...

Improper Input Validation

The weave server API is vulnerable to Improper Input Validation. The vulnerability is caused due to a missing validation while fetching files from a remote directory for allowed file paths. This allows to traverse and leak arbitrary files remotely and can lead to a low-privileged users assuming t...