2024

iTop is an IT service management platform. Files from the `env-production` folder can be retrieved even though they sho

Command injection vulnerability in the operating system. Improper neutralisation of special elements in Active Directory

Plaintext storage of a password issue exists in BUFFALO wireless LAN routers, which may allow a network-adjacent unauthe

The system application (com.transsion.kolun.aiservice) component does not perform an authentication check, which allows

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Realtyna Realtyna

The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset

Default credentials on the Web Interface of Evolution Controller 2.x allows anyone to log in to the server directly to p

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access contr

A vulnerability classified as critical was found in Xiongmai AHB7804R-MH-V2, AHB8004T-GL, AHB8008T-GL, AHB7004T-GS-V3, A

IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without suffi

SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability al

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affect

Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page para

An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Netwo

Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id pa

Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function d

NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers

D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function hnap_main. An attacke

Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

XWiki Platform is a generic wiki platform. Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extension

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc

XWiki Platform is a generic wiki platform. Starting in version 13.9-rc-1 and prior to versions 4.10.19, 15.5.4, and 15.1

XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, an

XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10

XWiki Platform is a generic wiki platform. In multilingual wikis, translations can be edited by any user who has edit ri

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, an

XWiki Platform is a generic wiki platform. Starting in version 3.0.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath

XWiki Platform is a generic wiki platform. Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9

An issue in the kiosk mode of Secure Lockdown Multi Application Edition v2.00.219 allows attackers to execute arbitrary

Out of bounds memory access in Compositing in Google Chrome prior to 123.0.6312.122 allowed a remote attacker who had co

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix crash in RX resync flow For t

Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior

Traccar is an open source GPS tracking system. Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded th

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eva

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input

BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerabilit

qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTIO

A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the

A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioTo

lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify

In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, crea

By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read a

A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/pe

An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui applicatio

The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of us