Out-of-bounds Read

Ollama is vulnerable to Out-of-bounds Read. The vulnerability is due to the ability to upload a malformed GGUF file containing only 4 bytes with a custom magic header. By using a custom Modelfile with a FROM statement pointing to an attacker-controlled blob, the attacker can cause a segmentation...

Improper Privilege Management

Zope and AccessControl is vulnerable to Improper Privilege Management. The vulnerability is due to anonymous users being able to delete user data in AccessControl.userfolder.UserFolder, potentially preventing privileged access. Users unable to upgrade can mitigate by adding dataroles = to...

Insecure Deserialization

Apache Lucene.Net.Replicator is vulnerable to Insecure Deserialization. The vulnerability exists due to the deserialization of untrusted data without adequate validation, allowing an attacker who intercepts traffic or controls the replication node URL to send a malicious JSON response...

Password Reset Attack

yeswiki/yeswiki is vulnerable to weak cryptographic algorithm. The vulnerability is due to poor cryptographic practices, specifically the use of a weak cryptographic algorithm and a hard-coded salt for hashing the password reset key, allowing attackers to recover the reset key and gain unauthoriz...

Signature Verification Bypass

laravel/reverb is vulnerable to a verification signature bypass. The vulnerability is due to missing verification of request signatures for the Pusher-compatible API endpoints, allows unauthorized requests to bypass security checks and potentially access sensitive functionality...

Denial Of Service (DoS)

github.com/consensys/gnark is vulnerable to a Denial of Service DoS. The vulnerability is due to improper memory allocation handling during the deserialization of Groth16 verification keys, allowing attackers to trigger excessive memory allocation, leading to high memory consumption and potential...

Denial Of Service (DoS)

github.com/hashicorp/vault is vulnerable to Denial Of Service DoS. The vulnerability is due to the Raft cluster join API endpoint, which allows an attacker to send a large volume of requests, leading to excessive memory consumption...

Remote Code Execution (RCE)

github.com/plentico/plenti is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of the /postLocal endpoint, which allows an attacker to write arbitrary files to the server when a Plenti user serves their website...

Path Traversal

Safearchive is vulnerable to a Path Traversal. The vulnerability is due to the handling of archive extractions on case-insensitive filesystems e.g., NTFS, which allows attackers to write arbitrary files by using symbolic links in the archive...

Arbitrary File Overwrite

HornetQ is vulnerable to Arbitrary File Overwrite. The vulnerability is due to an issue in the createTempFile method, which allows attackers to arbitrarily overwrite files or access sensitive information...

Arbitrary File Deletion

github.com/plentico/plenti is vulnerable to Arbitrary File Deletion. The vulnerability is due to insufficient input validation and lack of proper access controls on the /postLocal endpoint, allowing an attacker to manipulate file paths and trigger arbitrary file deletion when the Plenti user serv...

Prototype Pollution

DOMPurify is vulnerable to Prototype Pollution. The vulnerability is due to insufficient sanitization, allowing attackers to manipulate the prototype of JavaScript objects, potentially leading to unexpected behavior or security issues...

Improper Access Control

ICG.AspNetCore.Utilities.CloudStorage is vulnerable to Improper Access Control. The vulnerability is due to incorrect handling of the SAS Uri duration, which may result in a URL with an incorrect expiration time. It can allow an attacker to gain unauthorized access if the duration is too long, or...

Incorrect Security Setting

net.snowflake, snowflake-jdbc is vulnerable to an Incorrect Security Setting. The vulnerability is due to data being uploaded to an encrypted stage without client-side encryption, allowing unauthorized parties to access or modify sensitive information...

Understanding Deserialization

Thinkphp is vulnerable to Understanding Deserialization. The vulnerability is due to improper validation and handling of serialized user input in the \controller\Index.php component, allowing attackers to execute arbitrary code...

Improper Access Control

github.com/hashicorp/consul is vulnerable to Improper Access Control. The vulnerability is due to the ability to bypass HTTP header-based access rules when using headers in L7 traffic intentions, allowing unauthorized access in certain cases...

Cross-site Scripting (XSS)

github.com/hashicorp/consul is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the server's failure to explicitly set a Content-Type HTTP header in the response, allowing user-provided inputs to be misinterpreted, which can lead to reflected XSS attacks...

Path Traversal

github.com/hashicorp/consul is vulnerable to Path Traversal. The vulnerability is due to the bypass of HTTP request path-based access rules when using URL paths in L7 traffic intentions, allowing unauthorized access in specific scenarios...

Reliance On Untrusted Inputs In A Security Decision

Sinatra is vulnerable to Reliance on Untrusted Inputs in a Security Decision. The vulnerability is due to improper handling of the X-Forwarded-Host header via the X-Forwarded-Host header, allowing attackers to exploit Open Redirect Attacks, Cache Poisoning, or Routing-based SSRF through untrusted...

Arbitrary Code Execution (ACE)

lilconfig is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to the insecure usage of eval in the dynamicImport function, which allows an attacker to inject malicious input through the defaultLoaders function and execute arbitrary code...

Unauthorized Invite Deletion

github.com/grafana/grafana is vulnerable to unauthorized invite deletion. The vulnerability is due to insufficient access control validation in the system, where organization admins are not properly restricted to actions only within the organization they belong to. It allows admins to delete...

Path Traversal

langchain is vulnerable to path traversal. The vulnerability is due to improper input sanitization in the getFullPath method, which allows attackers to exploit the setFileContent, getParsedFile, and mdelete methods, enabling them to save files anywhere in the filesystem, overwrite existing text...

Arbitrary File Creation

github.com/nvidia/nvidia-container-toolkit is vulnerable to arbitrary file creation. The vulnerability is due to the default mode of operation, which allows a specially crafted container image to interact with the host file system and create empty files...

SQL Injection

@langchain/community is vulnerable to SQL injection. The vulnerability is due to improper handling of user input in the GraphCypherQAChain class, which allows attackers to inject malicious prompts that can lead to SQL injection...

SQL Injection

langchain-ai/langchain is vulnerable to SQL injection. The vulnerability is due to insufficient input validation in the GraphCypherQAChain class, which allows user-controlled inputs to be embedded in SQL queries without proper sanitization...

Time-of-check Time-of-use (TOCTOU) Race Condition

NVIDIA Container Toolkit is vulnerable to Time-of-Check Time-of-Use TOCTOU Race Condition. The vulnerability is due to a TOCTOU flaw in the default configuration, where a specifically crafted container image may gain unauthorized access to the host file system. This can lead to code execution,...

SQL Injection

org.jeecgframework.boot, jeecg-boot-parent is vulnerable to SQL Injection. The vulnerability is due to a SQL injection in the /onlDragDatasetHead/getTotalData component, which allows attackers to execute arbitrary SQL commands...

Remote Code Execution (RCE)

Langflow is vulnerable to Remote Code Execution RCE. The vulnerability exists due to insufficient validation in the PythonCodeTool component, which allows attackers to execute arbitrary code remotely...

Cross-Site Scripting (XSS)

Glossarizer is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improperly converting encoded special characters into legitimate HTML, allowing attackers to inject a malicious XSS payload into a glossary entry...

Unauthorized File Access

@oakserver/oak is vulnerable to Unauthorized File Access. The vulnerability is due to inadequate sanitization of URL-encoded characters in the Context.send API, allows attackers to encode / as %2F, bypassing the restriction on hidden files and potentially exposing sensitive data...

Local File Inclusion (LFI)

changedetectionio is vulnerable to local file inclusion LFI. The vulnerability is due to insufficient input validation and lack of proper security controls when handling file paths in WebDriver requests, allows the use of the source:file:///etc/passwd to bypass restrictions and access sensitive...

Cross-Site Request Forgery (CSRF)

Mattermost is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to improper sanitization of user inputs in the frontend used for redirection, allowing a one-click client-side path traversal that results in a cross-site request forgery CSRF in Playbooks...

Improper Access Control

Mattermost is vulnerable to Improper Access Control. The vulnerability is due to improper filtering of channel data when ElasticSearch is enabled, allowing users to access private channel names by using cmd+K/ctrl+K...

Denial Of Service (DoS)

Mattermost is vulnerable to Denial of Service DoS. The vulnerability is due to the failure to prevent detailed error messages from being displayed in Playbooks, which allows an attacker to generate a large GraphQL response. This can lead to application crashes when a specially crafted request is...

Missing Authorization

Mattermost is vulnerable to Missing Authorization. The vulnerability is due to a failure to check that the origin of the message in an integration action matches the original post metadata, which allows an authenticated user to delete an arbitrary post...

Improper Authentication

Kyverno is vulnerable to Improper Authentication. The vulnerability is due to the ability to override a ClusterPolicy such as "disallow-privileged-containers" by creating a PolicyException in any namespace. This design flaw allows users with privileges in non-Kyverno namespaces to create...

HTTP Request Smuggling (HRS)

Waitress is vulnerable to HTTP Request Smuggling HRS. The vulnerability is due to improper handling of request lookahead and parsing in HTTP pipelining. When request lookahead is enabled, the server processes the first request, but due to a race condition, it may start handling the second request...

Denial Of Service (DoS)

Waitress is vulnerable to Denial Of Service DoS. The vulnerability is due to a race condition where, if a remote client closes the connection before Waitress calls getpeername, allows an attacker to trigger a busy-loop in the server, causing it to repeatedly attempt writing to a non-existent sock...

Denial Of Service (DoS)

github.com/argoproj/argo-workflows is vulnerable to Denial Of Service DoS. The vulnerability is due to a race condition in a global variable within the file metricsk8srequest.go, allows an attacker with permission to execute workflows to trigger a crash in the Argo Workflows controller...

Incorrect Session Handling

github.com/mattermost/mattermost is vulnerable to Incorrect Session Handling. The vulnerability is due to improper session management during the use of Single Sign-On SSO, where two sessions—one in the browser and one on the desktop—are created without proper synchronization or settings, allowing...

Open Redirect

github.com/coder/coder is vulnerable to Open Redirect. The vulnerability is due to lack of proper input validation on the Coder login page, allows attackers to manipulate the URL and redirect users to malicious websites...

Leaked Token Reuse Attack

Duende IdentityServer is vulnerable to Leaked Token Reuse Attack. The vulnerability is due to insufficient validation of the cnf claim in DPoP access tokens by the LocalApiAuthenticationHandler. It allows attackers to misuse leaked tokens without requiring the private key needed for signing proof...

Remote Code Execution (RCE)

pyload-ng is vulnerable to Remote Code Execution RCE. The vulnerability exists due to improper input validation of HTTP requests, allowing attackers to execute arbitrary code...

Regular Expression Denial Of Service (ReDoS)

nope-validator is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to inefficient regular expressions, which allow for ReDoS attacks...

Cross-Site Scripting (XSS)

funadmin/funadmin is vulnerable to Cross Site Scripting XSS. The vulnerability is due to the lack of input validation and filtering of parameters passed to the param variable in the selectfiles method of \backend\controller\sys\Attachh.php, allowing an attacker to inject malicious scripts into th...

Path Traversal

werkzeug is vulnerable to Path Traversal. The vulnerability is due to inadequate handling of UNC paths in the os.path.isabs function, which results in safejoin not properly validating the path, allowing an attacker to manipulate the path and gain unauthorized access to files or directories...

Regular Expression Denial Of Service (ReDoS)

Knwl.js is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the presence of inefficient regular expressions, which allow attackers to craft input that causes excessive backtracking, leading to high CPU usage and potential service disruption...

Privilege Escalation

github.com/rancher/rancher is vulnerable to Privilege Escalation. The vulnerability is due to the use of untrusted cluster or node drivers that run at a privileged level, allowing them to escape the chroot jail and gain unauthorized access to the Rancher container or, in the case of privileged...

Sybil Attacks

github.com/libp2p/go-libp2p-kad-dht is vulnerable to Sybil attacks. The vulnerability is due to the method of assigning routing information based on the DHT distance between peer IDs and content IDs, allows attackers to generate many Sybil peers with small DHT distances, enabling them to disrupt ...

Regular Expression Denial Of Service (ReDoS)

Foundation is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to the use of inefficient or poorly optimized regular expressions, allows an attacker for excessive backtracking, which can be exploited in a ReDoS attack to overwhelm the system with resource-intensi...