2024

luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.

A Stack Buffer Overflow vulnerability in zziplibv 0.13.77 allows attackers to cause a denial of service via the __zzip_f

A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the

D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downlo

The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnera

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or co

VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicio

VMware Cloud Director contains an Improper Privilege Management vulnerability. An authenticated tenant administrator

VMware Workspace One UEM update addresses an information exposure vulnerability.  A malicious actor with network access

BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. A remote

luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.

lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.

Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_pars

A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the fun

Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the functi

Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authenti

DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code.

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint

A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other

In version 1.2.7 of lunary-ai/lunary, any authenticated user, regardless of their role, can change the name of an organi

A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerabilit

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt.

A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path t

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' param

A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker to delete

A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest versi

stangirard/quivr version 0.0.236 contains a Server-Side Request Forgery (SSRF) vulnerability. The application does not p

In the latest version of vanna-ai/vanna, the `vanna.ask` function is vulnerable to remote code execution due to prompt i

A path traversal vulnerability in the `/set_personality_config` endpoint of parisneo/lollms version 9.4.0 allows an atta

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatG

An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious websit

In lunary-ai/lunary versions <=v1.2.11, an attacker can bypass email validation by using a dot character ('.') in the em

BerriAI/litellm version v1.35.8 contains a vulnerability where an attacker can achieve remote code execution. The vulner

In lunary-ai/lunary version 1.2.4, an improper access control vulnerability allows members with team management permissi

berriai/litellm version 1.34.34 is vulnerable to improper access control in its team management functionality. This vuln

This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate

Vulnerability in Spotfire Spotfire Enterprise Runtime for R - Server Edition, Spotfire Spotfire Statistics Services, Spo

Vulnerability in Spotfire Spotfire Analyst, Spotfire Spotfire Server, Spotfire Spotfire for AWS Marketplace allows In th

An unauthenticated IEEE 802.15.4 'co-ordinator realignment' packet can be used to force Zigbee nodes to change their net

In a Silicon Labs  multi-protocol gateway, a corrupt pointer to buffered data on a multi-protocol radio co-processor (

SDG Technologies PnPSCADA allows a remote attacker to attach various entities without requiring system authentication. T

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the ne

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to impro

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to impro