CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows a...

Composio Path Traversal Vulnerability

Composio is a production-ready toolset for AI agents open-sourced by Composio. A path traversal vulnerability exists in Composio version 0.5.8 and prior versions, which stems from the fact that incorrect manipulation of the parameter file can lead to path traversal. No details of the vulnerabilit...

CVE-2024-7928 FastAdmin lang path traversal

A vulnerability, which was classified as problematic, has been found in FastAdmin up to 1.3.3.20220121. Affected by this issue is some unknown functionality of the file /index/ajax/lang. The manipulation of the argument lang leads to path traversal. The attack may be launched remotely. The exploi...

CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the pluginserver, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path...

EUVD-2024-2113

CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the ExtensionBuilder.buildextension function. The vulnerability arises from the /mountextension endpoint, where a path traversal issue allows attackers to navigate beyond the intended directory structure...

CVE-2024-36117 Path traversal while serving Reposilite javadoc expanded files

Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version...

CVE-2024-4315

CVE-2024-4315 affects parisneo/lollms v9.5 and is a Local File Inclusion (LFI) flaw caused by insufficient path sanitization in the function that processes endpoints. The code fails to properly sanitize Windows-style paths (backslash), enabling directory traversal on Windows systems. Attackers co...

PT-2024-35123 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: A path traversal issue allows a manager to bypass the normalizePath function, enabling them to read, delete, or overwrite the 'anythingllm.db' database file and other files in the...

NS-ASG application security gateway. Attackers exploit vulnerabilities

Beijing Wangkang Technology Co., Ltd. is a leading provider of n...

PT-2024-12660 · Phlox · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme versions n/a through 2.14.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability...

ModelDB Path Traversal Vulnerability

ModelDB is an open source system for machine learning model version control, metadata and experiment management open source by VertaAI. ModelDB suffers from a path traversal vulnerability that arises from improper cleaning of user-supplied file paths in the file upload function. This vulnerabilit...

PT-2024-26659

Name of the Vulnerable Software and Affected Versions langchain-ai/langchain affected versions not specified Description langchain-ai/langchain is susceptible to a path traversal issue stemming from insufficient restriction of pathnames within its LocalFileStore functionality. This allows attacke...

PT-2024-4072 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: qdrant/qdrant version 1.9.0-dev Description: The issue is related to improper input validation in the "/collections/name/snapshots/upload" endpoint, allowing for path traversal. By manipulating the name parameter through URL encoding, an...

PT-2024-1800

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 23.9.8 Description ConnectWise ScreenConnect contains a path traversal flaw caused by improper restriction of the path name to a restricted directory. This issue allows a remote attacker to execute...

CVE-2024-23822 Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)

Thruk is a multibackend monitoring webinterface. Prior to 3.12, the Thruk web monitoring application presents a vulnerability in a file upload form that allows a threat actor to arbitrarily upload files to the server to any path they desire and have permissions for. This vulnerability is known as...

PT-2023-32817 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: mlflow versions prior to 2.9.2 Description: The issue concerns a path traversal vulnerability. It involves the use of '..filename' in the GitHub repository mlflow/mlflow. Recommendations: For versions prior to 2.9.2, update to version 2.9.2 o...

CVE-2023-6209

Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override the specified host. This could contribute to security problems in web sites. This vulnerability affects Firefox 120, Firefox ESR 115.5.0, and Thunderbird 115.5...

SuiteCRM Path Traversal Vulnerability (CNVD-2024-28191)

SuiteCRM is a customer relationship management system from the SuiteCRM team. SuiteCRM suffers from a path traversal vulnerability that stems from the program failing to properly filter for specific elements in the path of a resource or file. An attacker could exploit this vulnerability to retrie...

PT-2023-8926 · Sysaid · Sysaid

Name of the Vulnerable Software and Affected Versions: SysAid affected versions not specified Description: The issue is related to a path traversal vulnerability in the doPost method of the com.ilient.server.UserEntry class in SysAid, a service support and hardware and software control automation...

PT-2023-6455

Name of the Vulnerable Software and Affected Versions Samba affected versions not specified Description A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. This could result in SMB clients connectin...