2024 CVEs (page 21)
Page 21 of 385 — CVEs published in 2024, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11137 | High | 7.5 | 2025-03-20 | An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0. This vulnerabilit… |
CVE-2024-11045 | Critical | 9.6 | 2025-03-20 | A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server ex… |
CVE-2024-11044 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary w… |
CVE-2024-11043 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the /api/v1/boards/{board_id} endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occur… |
CVE-2024-11042 | Critical | 9.1 | 2025-03-20 | In invoke-ai/invokeai version v5.0.2, the web API `POST /api/v1/images/delete` is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized… |
CVE-2024-11041 | Critical | 9.8 | 2025-03-20 | vllm-project vllm version v0.6.2 contains a vulnerability in the MessageQueue.dequeue() API function. The function uses pickle.loads to parse received sockets… |
CVE-2024-11039 | High | 8.8 | 2025-03-20 | A pickle deserialization vulnerability exists in the Latex English error correction plug-in function of binary-husky/gpt_academic versions up to and including… |
CVE-2024-11037 | Medium | 6.5 | 2025-03-20 | A path traversal vulnerability exists in binary-husky/gpt_academic at commit 679352d, which allows an attacker to bypass the blocked_paths protection and read… |
CVE-2024-11033 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handl… |
CVE-2024-11031 | High | 7.5 | 2025-03-20 | In version 3.83 of binary-husky/gpt_academic, a Server-Side Request Forgery (SSRF) vulnerability exists in the Markdown_Translate.get_files_from_everything() A… |
CVE-2024-11030 | High | 7.5 | 2025-03-20 | GPT Academic version 3.83 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability through its HotReload plugin function, which calls the crazy_util… |
CVE-2024-10986 | High | 8.8 | 2025-03-20 | GPT Academic version 3.83 is vulnerable to a Local File Read (LFI) vulnerability through its HotReload function. This function can download and extract tar.gz… |
CVE-2024-10956 | High | 7.1 | 2025-03-20 | GPT Academy version 3.83 in the binary-husky/gpt_academic repository is vulnerable to Cross-Site WebSocket Hijacking (CSWSH). This vulnerability allows an atta… |
CVE-2024-10955 | Medium | 6.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern `r'<… |
CVE-2024-10954 | High | 8.8 | 2025-03-20 | In the `manim` plugin of binary-husky/gpt_academic, versions prior to the fix, a vulnerability exists due to improper handling of user-provided prompts. The ro… |
CVE-2024-10950 | High | 8.8 | 2025-03-20 | In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The root cause is the ex… |
CVE-2024-10948 | Medium | 6.5 | 2025-03-20 | A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensitive files such as `c… |
CVE-2024-10940 | Medium | 5.3 | 2025-03-20 | A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrary files from the ho… |
CVE-2024-10935 | High | 7.5 | 2025-03-20 | automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multi… |
CVE-2024-10912 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. The vulnerability is due to improper handling of f… |
CVE-2024-10908 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specia… |
CVE-2024-10907 | High | 7.5 | 2025-03-20 | In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by… |
CVE-2024-10906 | High | 8.1 | 2025-03-20 | In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Acc… |
CVE-2024-10902 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerabil… |
CVE-2024-10901 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/chart/run` allows execution of arbitrary SQL queries without any access control. This v… |
CVE-2024-10835 | Critical | 9.8 | 2025-03-20 | In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /api/v1/editor/sql/run` allows execution of arbitrary SQL queries without any access control. This vul… |
CVE-2024-10834 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the abilit… |
CVE-2024-10833 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is suscep… |
CVE-2024-10831 | Critical | 9.1 | 2025-03-20 | In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to uploa… |
CVE-2024-10830 | High | 8.2 | 2025-03-20 | A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an att… |
CVE-2024-10829 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers t… |
CVE-2024-10821 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server (version v5.0.1) allows unauthenticated… |
CVE-2024-10819 | High | 8.8 | 2025-03-20 | A Cross-Site Request Forgery (CSRF) vulnerability in version 3.83 of binary-husky/gpt_academic allows an attacker to trick a user into uploading files without… |
CVE-2024-10812 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-… |
CVE-2024-10762 | High | 8.1 | 2025-03-20 | In lunary-ai/lunary before version 1.5.9, the /v1/evaluators/ endpoint allows users to delete evaluators of a project by sending a DELETE request. However, the… |
CVE-2024-10727 | Medium | 6.1 | 2025-03-20 | A reflected cross-site scripting (XSS) vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application rece… |
CVE-2024-10725 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts in… |
CVE-2024-10724 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the… |
CVE-2024-10723 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious sc… |
CVE-2024-10722 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into… |
CVE-2024-10721 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious sc… |
CVE-2024-10720 | Medium | 6.1 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'A… |
CVE-2024-10719 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allow… |
CVE-2024-10718 | High | 7.5 | 2025-03-20 | In phpipam/phpipam version 1.5.1, the Secure attribute for sensitive cookies in HTTPS sessions is not set. This could cause the user agent to send those cookie… |
CVE-2024-10714 | High | 7.5 | 2025-03-20 | A vulnerability in binary-husky/gpt_academic version 3.83 allows an attacker to cause a Denial of Service (DoS) by adding excessive characters to the end of a… |
CVE-2024-10713 | High | 7.5 | 2025-03-20 | A vulnerability in szad670401/hyperlpr v3.0 allows for a Denial of Service (DoS) attack. The server fails to handle excessive characters appended to the end of… |
CVE-2024-10707 | Medium | 6.5 | 2025-03-20 | gaizhenbiao/chuanhuchatgpt version git d4ec6a3 is affected by a local file inclusion vulnerability due to the use of the gradio component gr.JSON, which has a… |
CVE-2024-10650 | High | 7.5 | 2025-03-20 | An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payl… |
CVE-2024-10648 | High | 8.2 | 2025-03-20 | A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to c… |
CVE-2024-10624 | High | 7.5 | 2025-03-20 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the gradio-app/gradio repository, affecting the gr.Datetime component. The affected vers… |
CVE-2024-10572 | High | 7.5 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExt… |
CVE-2024-10569 | High | 7.5 | 2025-03-20 | A vulnerability in the dataframe component of gradio-app/gradio (version git 98cbcae) allows for a zip bomb attack. The component uses pd.read_csv to process i… |
CVE-2024-10553 | Critical | 9.8 | 2025-03-20 | A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untruste… |
CVE-2024-10550 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specif… |
CVE-2024-10549 | High | 7.5 | 2025-03-20 | A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified stri… |
CVE-2024-10513 | High | 7.2 | 2025-03-20 | A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. Thi… |
CVE-2024-10481 | Medium | 6.5 | 2025-03-20 | A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited… |
CVE-2024-10457 | Medium | 6.5 | 2025-03-20 | Multiple Server-Side Request Forgery (SSRF) vulnerabilities were identified in the significant-gravitas/autogpt repository, specifically in the GitHub Integrat… |
CVE-2024-10366 | Medium | 6.5 | 2025-03-20 | An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does n… |
CVE-2024-10363 | Medium | 5.4 | 2025-03-20 | In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted pe… |
CVE-2024-10361 | Critical | 9.1 | 2025-03-20 | An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability ar… |
CVE-2024-10359 | Medium | 4.6 | 2025-03-20 | In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through… |
CVE-2024-10330 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary version 1.5.6, the `/v1/evaluators/` endpoint lacks proper access control, allowing any user associated with a project to fetch all evaluat… |
CVE-2024-10275 | High | 7.3 | 2025-03-20 | In version 1.5.5 of lunary-ai/lunary, a vulnerability exists where admins, who do not have direct permissions to access billing resources, can change the permi… |
CVE-2024-10274 | Medium | 6.5 | 2025-03-20 | An improper authorization vulnerability exists in lunary-ai/lunary version 1.5.5. The /users/me/org endpoint lacks adequate access control mechanisms, allowing… |
CVE-2024-10273 | Medium | 6.5 | 2025-03-20 | In lunary-ai/lunary v1.5.0, improper privilege management in the models.ts file allows users with viewer roles to modify models owned by others. The PATCH endp… |
CVE-2024-10272 | High | 7.5 | 2025-03-20 | lunary-ai/lunary is vulnerable to broken access control in the latest version. An attacker can view the content of any dataset without any kind of authorizatio… |
CVE-2024-10267 | High | 7.5 | 2025-03-20 | An information disclosure vulnerability exists in the latest version of transformeroptimus/superagi. An attacker can leak sensitive user information, including… |
CVE-2024-10264 | Critical | 9.8 | 2025-03-20 | HTTP Request Smuggling vulnerability in netease-youdao/qanything version 1.4.1 allows attackers to exploit inconsistencies in the interpretation of HTTP reques… |
CVE-2024-10252 | High | 7.2 | 2025-03-20 | A vulnerability in langgenius/dify versions <=v0.9.1 allows for code injection via internal SSRF requests in the Dify sandbox service. This vulnerability enabl… |
CVE-2024-10225 | High | 7.5 | 2025-03-20 | A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a mul… |
CVE-2024-10190 | Critical | 9.8 | 2025-03-20 | Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-e… |
CVE-2024-10188 | High | 7.5 | 2025-03-20 | A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service (DoS) by exploiting the use of ast.literal_… |
CVE-2024-10110 | High | 7.5 | 2025-03-20 | In version 3.23.0 of aimhubio/aim, the ScheduledStatusReporter object can be instantiated to run on the main thread of the tracking server, leading to the main… |
CVE-2024-10109 | High | 8.3 | 2025-03-20 | A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/syste… |
CVE-2024-10051 | High | 7.5 | 2025-03-20 | Realchar version v0.0.4 is vulnerable to an unauthenticated denial of service (DoS) attack. The vulnerability exists in the file upload request handling, where… |
CVE-2024-10047 | Medium | 5.3 | 2025-03-20 | parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows… |
CVE-2024-10019 | Medium | 6.7 | 2025-03-20 | A vulnerability in the `start_app_server` function of parisneo/lollms-webui V12 (Strawberry) allows for path traversal and OS command injection. The function d… |
CVE-2024-0640 | Medium | 4.8 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in chatwoot/chatwoot versions 3.0.0 to 3.5.1. This vulnerability allows an admin user to inject malici… |
CVE-2024-0245 | Medium | 5.5 | 2025-03-20 | A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious application… |
CVE-2024-54016 | Medium | 4.3 | 2025-03-20 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): thr… |
CVE-2024-47552 | Critical | 9.8 | 2025-03-20 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): from 2.0.0 before 2.2.0. … |
CVE-2024-12016 | Critical | 9.8 | 2025-03-20 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection. This issue… |
CVE-2024-13881 | High | 7.1 | 2025-03-20 | The Link My Posts WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Sit… |
CVE-2024-13880 | High | 7.1 | 2025-03-20 | The My Quota WordPress plugin through 1.0.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13878 | High | 7.1 | 2025-03-20 | The SpotBot WordPress plugin through 0.1.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2024-13877 | High | 7.1 | 2025-03-20 | The Passbeemedia Web Push Notification WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading t… |
CVE-2024-13876 | High | 7.1 | 2025-03-20 | The mEintopf WordPress plugin through 0.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site S… |
CVE-2024-13875 | High | 7.1 | 2025-03-20 | The WP-PManager WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2024-55009 | Medium | 6.1 | 2025-03-19 | A reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows attackers to execute ar… |
CVE-2024-7631 | Medium | 4.3 | 2025-03-19 | A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and n… |
CVE-2024-57061 | Critical | 9.8 | 2025-03-19 | An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electron Fuses configurati… |
CVE-2024-51459 | High | 8.4 | 2025-03-19 | IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions. |
CVE-2024-25132 | Medium | 4.3 | 2025-03-19 | A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with t… |
CVE-2024-53970 | Medium | 5.4 | 2025-03-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2024-53969 | Medium | 5.4 | 2025-03-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute ar… |
CVE-2024-53968 | Medium | 5.4 | 2025-03-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute ar… |
CVE-2024-53967 | Medium | 5.4 | 2025-03-19 | Adobe Experience Manager versions 6.5.21 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited to execute ar… |
CVE-2024-42176 | Low | 2.6 | 2025-03-19 | HCL MyXalytics is affected by concurrent login vulnerability. A concurrent login vulnerability occurs when simultaneous active sessions are allowed for a singl… |
CVE-2024-55551 | High | 8.3 | 2025-03-19 | An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injectio… |