2024

Phpgurukul Tourism Management System v2.0 is vulnerable to Unrestricted Upload of File with Dangerous Type via tms/admin

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in AitThemes Citadela Listing.This issue affect

A vulnerability was found in Tenda W20E 15.11.0.6. It has been declared as critical. This vulnerability affects the func

Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that w

Memory safety bug present in Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9. This bug showed evidence of memory c

It was possible to mutate a JavaScript object so that the JIT could crash while tracing it. This vulnerability affects F

The JIT created incorrect code for arguments in certain cases. This led to potential use-after-free crashes during garba

A use-after-free could occur during WASM execution if garbage collection ran during the creation of an array. This vulne

In some code patterns the JIT incorrectly optimized switch statements and generated code with out-of-bounds-reads. This

A use-after-free could result if a JavaScript realm was in the process of being initialized when a garbage collection st

GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects

The API in Accredible Credential.net December 6th, 2023 allows an Insecure Direct Object Reference attack that discloses

The WooCommerce Google Feed Manager plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all ve

Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.

Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perf

In scrapy version 2.10.1, an issue was identified where the Authorization header, containing credentials for server auth

The scrapy/scrapy project is vulnerable to XML External Entity (XXE) attacks due to the use of lxml.etree.fromstring for

langchain-ai/langchain is vulnerable to path traversal due to improper limitation of a pathname to a restricted director

In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to

mintplex-labs/anything-llm is vulnerable to improper input validation, allowing attackers to read and delete arbitrary f

vertaai/modeldb is vulnerable to a path traversal attack due to improper sanitization of user-supplied file paths in its

An incorrect authorization vulnerability exists in the lunary-ai/lunary repository, specifically within the evaluations.

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. Th

An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary repository, version 0.3.0, withi

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smu

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attack

An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functio

A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflo

A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on th

An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http

Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities.

mintplex-labs/anything-llm is vulnerable to a relative path traversal attack, allowing unauthorized attackers with a def

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to exe

A specific malformed fragmented packet type (fragmented packets may be generated automatically by devices that send lar

An issue in Fireboltt Dream Wristphone BSW202_FB_AAC_v2.0_20240110-20240110-1956 allows attackers to cause a Denial of S

An input validation vulnerability exists in the Rockwell Automation 5015-AENFTXT that causes the secondary adapter to r

An arbitrary file upload vulnerability in the Add Category function of Codoforum v4.9 allows attackers to execute arbitr

SQL Injection vulnerability in sourcecodester Petrol pump management software v1.0, allows remote attackers to execute a

An issue discovered in silex technology DS-600 Firmware v.1.4.1 allows a remote attacker to obtain sensitive information

A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevat

An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated p

An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to exe

A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbi

A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevat

iTop is an IT service management platform. When exporting data from backoffice or portal in CSV or Excel files, users'

iTop is an IT service management platform. When displaying/editing the user's personal tokens, XSS attacks are possible

iTop is an IT service management platform. When dashlet are refreshed, XSS attacks are possible. This vulnerability is

iTop is an IT service management platform. By filling malicious code in an object friendlyname / complementary name, an