Advisory Catalog

Apache OFBiz Incorrect Authorization Vulnerability

Apache Airflow Providers FAB Insufficient Session Expiration vulnerability

Elliptic allows BER-encoded signatures

A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to improper validation of file paths, enabl

@75lb/deep-merge Prototype Pollution vulnerability

Studio 42 elFinder vulnerable to Incorrect Access Control

Admidio Vulnerable to RCE via Arbitrary File Upload in Message Attachment

Admidio has Blind SQL Injection in ecard_send.php

RaspAP allows an attacker to escalate privileges

Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

TorchServe vulnerable to bypass of allowed_urls configuration

Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the templat

Apache Superset vulnerable to improper SQL authorization

TorrentPier Deserialization of Untrusted Data vulnerability

langchain-experimental vulnerable to Arbitrary Code Execution

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows an attacker to create arbitrary folders at any location on the server, including the root directory (C: dir). This can lead to uncontrolled resource consumption, resulting in resource exhaustion, denial of service (DoS), server un

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to restart the server at will by sending a specific request to the `/queue/join?` endpoint with `"fn_index":66`. This unrestricted server restart capability can severely disrupt service availability, cause data loss or co

Palo Alto Networks Expedition Missing Authentication Vulnerability

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

ServiceNow Improper Input Validation Vulnerability

node-stringbuilder vulnerable to Out-of-bounds Read

EGroupware mishandles an ORDER BY clause

Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py

Apache HTTP Server Improper Escaping of Output Vulnerability

ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

OSGeo GeoServer GeoTools Eval Injection Vulnerability

ejson shell parser in MongoDB Compass maybe bypassed

robinweser fast-loops vulnerable to prototype pollution

jrburke requirejs vulnerable to prototype pollution

Prototype pollution in ag-grid-community via the _.mergeDeep function

jsonic was discovered to contain a prototype pollution via the function empty.

ntlk unsafe deserialization vulnerability

pytorch-lightning vulnerable to Arbitrary File Write via /v1/runs API endpoint

vanna vulnerable to remote code execution caused by prompt injection

A Server-Side Request Forgery (SSRF) vulnerability exists in the upload processing interface of gaizhenbiao/ChuanhuChatGPT versions <= ChuanhuChatGPT-20240410-git.zip. This vulnerability allows attackers to send crafted requests from the vulnerable server to internal or external resources, potential

litellm vulnerable to remote code execution based on using eval unsafely

Craft CMS SQL injection vulnerability via the GraphQL API endpoint

Progress WhatsUp Gold Path Traversal Vulnerability

Remote Code Execution via path traversal bypass in lollms

Broadcom VMware vCenter Server Out-of-bounds Write Vulnerability

obx Prototype Pollution

object-deep-assign Prototype Pollution

@cdr0/sg Prototype Pollution

GeoVision Devices OS Command Injection Vulnerability

Magento Open Source Improper Access Control vulnerability

Magento Open Source Improper Authentication vulnerability

Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability

Apache Submarine Server Core Incorrect Authorization vulnerability