CVE-2024-6139

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in...

PT-2024-37414

Name of the Vulnerable Software and Affected Versions: parisneo/lollms version v9.6 Description: A path traversal issue exists, allowing an attacker to write audio files to arbitrary system locations and enumerate file paths. This is due to improper validation of user-provided file paths in the t...

CVE-2024-31206 Use of Unencrypted HTTP Request in dectalk-tts

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victi...

CVE-2024-31206

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In "[email protected]", network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the...

CVE-2024-31206

CVE-2024-31206 affects the Node package dectalk-tts . In 1.0.0, the module makes HTTP (unencrypted) requests to the aeiou Dectalk web API, creating a potential man-in-the-middle risk where traffic could be intercepted or modified. The network traffic was upgraded to HTTPS in version 1.0.1. The av...

dectalk-tts Uses Unencrypted HTTP Request

Impact In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle MITM attack. Theft Because dectalk-tts is ...

GHSA-6CF6-8HVR-R68W dectalk-tts Uses Unencrypted HTTP Request

Impact In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victim of a man-in-the-middle MITM attack. Theft Because dectalk-tts is ...

PT-2024-23850

Name of the Vulnerable Software and Affected Versions dectalk-tts version 1.0.0 Description The issue arises from the use of unencrypted HTTP for network requests to the third-party API in [email protected]. This allows attackers to easily intercept and modify traffic, potentially leading to...

CVE-2024-31206: Channel Accessible by Non-Endpoint

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In [email protected], network requests to the third-party API are sent over HTTP, which is unencrypted. Unencrypted traffic can be easily intercepted and modified by attackers. Anyone who uses the package could be the victi...

dectalk-tts 安全漏洞

dectalk-tts is a simple Node package from Justin McBride's personal developer. A security vulnerability exists in dectalk-tts version 1.0.0, which stems from the use of unencrypted HTTP requests that are vulnerable to interception and modification by an attacker...

GHSA-JX6Q-FQ9H-6G7Q Pedroetb TTS-API OS Command Injection

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

Pedroetb TTS-API OS Command Injection

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

CVE-2019-25158

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

CVE-2019-25158

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

Command injection

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

CVE-2019-25158

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

CVE-2019-25158 pedroetb tts-api app.js onSpeechDone os command injection

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...

CVE-2019-25158

CVE-2019-25158 affects pedroetb tts-api up to version 2.1.4. The vulnerability is in the onSpeechDone function of app.js, enabling OS command injection. A fix is available in version 2.2.0, with the patch identified as 29d9c25415911ea2f8b6de247cb5c4607d13d434. Upgrading to 2.2.0 is recommended to...

PT-2023-11383 · Pedroetb · Tts-Api

Name of the Vulnerable Software and Affected Versions: pedroetb tts-api versions up to 2.1.4 Description: A critical vulnerability has been found in the pedroetb tts-api, affecting the onSpeechDone function of the file app.js. This issue leads to os command injection. Recommendations: For pedroet...

CVE-2019-25158: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in pedroetb tts-api up to 2.1.4 and classified as critical. This vulnerability affects the function onSpeechDone of the file app.js. The manipulation leads to os command injection. Upgrading to version 2.2.0 is able to address this issue. The patch is identified as...