Advisory Catalog

ingress-nginx controller - auth secret file path traversal vulnerability

Kyverno ignores subjectRegExp and IssuerRegExp

API Platform Core does not call GraphQl securityAfterResolver

GetmeUK ContentTools Cross-Site Scripting (XSS)

yiisoft Yii2 Deserialization of Untrusted Data

Envoy crashes when HTTP ext_proc processes local replies

Parse Server has an OAuth login vulnerability

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remo

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The at

Mattermost allows members with permission to convert public channels to private and convert private to public

Mattermost Fails to Enforce Certain Search APIs

Mattermost Fails to Restrict Bookmark Creation and Updates in Archived Channels

Mattermost Fails to Restrict Command Execution in Archived Channels

OWASP Coraza WAF has parser confusion which leads to wrong URI in `REQUEST_FILENAME`

LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality

Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

Open WebUI Allows Viewing of Admin Details

BentoML Open Redirect vulnerability

MLflow has Weak Password Requirements

SageMaker Workflow component allows possibility of MD5 hash collisions

A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server b

A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the

An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to restart the server at will, leading to a complete loss of availability. The issue arises because the function responsible for restarting the server is not properly

A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code b

AgentScope stored cross-site scripting (XSS) vulnerability

Gradio Vulnerable to Open Redirect

Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

H2O Vulnerable to Execution of Arbitrary Files

Flask-CORS allows for inconsistent CORS matching

Flask-CORS improper regex path matching vulnerability

MLflow Uncontrolled Resource Consumption vulnerability

TorchServe script references S3 bucket without ensuring ownership or confirming accessibility

Aim Relative Path Traversal vulnerability

LlamaIndex Uncontrolled Resource Consumption vulnerability

Aim vulnerable to Synchronous Access of Remote Resource without Timeout

Gradio Path Traversal vulnerability

A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<[^>]+>'` to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An att

langchain-core allows unauthorized users to read arbitrary files from the host file system

FastChat open redirect vulnerability

gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a known issue (CVE-2024-4941). This vulnerability allows unauthenticated users to access arbitrary files on the server by uploading a specially

OpenShift Console Has a Path Traversal Vulnerability

Drupal Core Cross-Site Scripting (XSS) Vulnerability

Drupal Formatter Suite Vulnerable to Cross-Site Scripting (XSS) via Link Element Attributes

Drupal RapiDoc OAS Field Formatter Cross-Site Scripting (XSS) vulnerability

Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability

OpenShift Hive Has an Uncontrolled Resource Consumption Vulnerability

Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout

vLLM denial of service via outlines unbounded cache on disk

Fast-JWT Improperly Validates iss Claims