Auto-GPT Cross-Site Request Forgery Vulnerability

Auto-GPT is an artificial intelligence software agent program open-sourced by Significant Gravitas. Auto-GPT version 0.5.0 suffers from a cross-site request forgery vulnerability that stems from an unprotected API endpoint that receives commands, which allows an attacker to execute arbitrary...

GO-2024-2799 MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot

MCUboot Injection attack of unprotected TLV values in github.com/mcu-tools/mcuboot...

The vulnerability of the CI/CD application integration and delivery system provided by JetBrains TeamCity, due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of the CI/CD application integration and delivery system of JetBrains TeamCity exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability in the projets.php script of the SOPlanning CMS system allows a hacker to execute arbitrary SQL queries.

The vulnerability of the projets.php script within the SOPlanning CMS system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

The vulnerability of the `BaproductzoommagnifierZoomModuleFrontController::run()` method in the Best Zoom Magnifier Effect module – BAZoom Magnifier, a open-source e-commerce web application for PrestaShop. This vulnerability allows an attacker to elevate their privileges and gain access to read, modify, or delete data.

The vulnerability of the BaproductzoommagnifierZoomModuleFrontController::run method in the Best Zoom Magnifier Effect – BAZoom Magnifier web application for e-commerce with open-source PrestaShop is related to the lack of protective measures for the SQL query structure. Exploiting this...

ROS-20240529-01

Vulnerability in the Lightweight HTTP Server component of the Oracle Java SE software platform and virtual machine Oracle GraalVM Enterprise Edition is related to unrestricted resource allocation. Exploitation exploitation of the vulnerability could allow a remote attacker to cause a denial of...

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system, related to the lack of protection for operational data, allows a intruder to gain unauthorized access to confidential information.

The vulnerability of the Siemens RUGGEDCOM CROSSBOW access control system lies in the lack of protection for operational data. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to confidential information...

The vulnerability of Microsoft Dynamics 365 Customer Insights’ CDP platform allows a hacker to perform spear-phishing attacks.

The vulnerability of the Microsoft Dynamics 365 Customer Insights CDP platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out spear-phishing attacks...

Tenable Network Security Nessus 安全漏洞

Tenable Network Security Nessus is a network vulnerability scanning tool developed by Tenable Network Security to detect security vulnerabilities and configuration errors in operating systems, network devices, and applications. Tenable Network Security Nessus suffers from an elevation of privileg...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to 9.3, which stems from insufficient protection of the /applysettings and /executecode endpoints, allowing remote attackers to execute...

The vulnerability of the microprogrammed software of the MELSEC iQ-R Series Safety CPU and Series SIL2 Process CPU modules, which stems from the lack of protection for operational data, allows unauthorized access by intruders to the protected information.

The vulnerability of the microprogrammed software of MELSEC iQ-R Series Safety CPUs and Series SIL2 Process CPUs is related to the lack of protection for operational data. Exploiting this vulnerability can allow an unauthorized person to gain unauthorized access to protected information...

PT-2024-13351 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.5.0 Description: The issue allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file, which is executed on every page load...

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes, related to the failure to protect the SQL request structure, allows attackers to execute arbitrary SQL queries.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the lack of measures taken to protect the SQL request structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2024-32883

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

WordPress WP-Members Membership Plugin plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files vulnerability

Unprotected Storage of Potentially Sensitive Files vulnerability discovered by Tim Coen in WordPress Plugin WP-Members versions = 3.4.9.3...

The vulnerability of TOTOLINK N300RT router microprogramming software, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of TOTOLINK N300RT router microprogramming software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to carry out XSS attacks...

The vulnerability of the operating environment for managing and maintaining the Dell Unity Operating Environment (DELL Unity OE) allows attackers to carry out XSS attacks. This vulnerability arises due to the lack of measures taken to protect the structure of the web page, enabling attackers to execute such attacks.

The vulnerability in the operating environment for managing and maintaining Dell Unity Operating Environment OE exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2024-1491

CVE-2024-1491 affects Electrolink FM/DAB/TV Transmitters, where an unauthenticated unprotected endpoint permits MPFS2 file-system binary image uploads. The MPFS2 read-only storage can reside in external EEPROM/flash and backs the HTTP2 web server and other components; exploitation could overwrite...

Electrolink FM/DAB/TV Transmitter 访问控制错误漏洞

The Electrolink FM/DAB/TV Transmitter is a series of transmitters from Electrolink. The Electrolink FM/DAB/TV Transmitter suffers from an access control error vulnerability that originates from allowing an attacker to access an unprotected endpoint and upload a binary image via the MPFS file syst...