deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3104
Published: 2024-06-06
Description: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service. 
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/mintplex-labs/anything-llm/commit/bfedfebfab032e6f4d5a369c8a2f947c5d0c5286; https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462; https://github.com/mintplex-labs/anything-llm/commit/bfedfebfab032e6f4d5a369c8a2f947c5d0c5286
CVE: CVE-2024-3152
Published: 2024-06-06
Description: mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918, CWE-755
References: https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc; https://huntr.com/bounties/46034fa0-d623-49f8-8ee8[PII_REDACTED]73; https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc
CVE: CVE-2024-3504
Published: 2024-06-06
Description: An improper access control vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, where an admin can update any organization user to the organization owner. This vulnerability allows the elevated user to delete projects within the organization. The issue is resolved in version 1.2.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f; https://huntr.com/bounties/97958fe4-be21-4b63-966f-8337c72c8e28; https://github.com/lunary-ai/lunary/commit/f7507f0949f6634f725ebb8da37c44f76542901f
CVE: CVE-2024-4325
Published: 2024-06-06
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the gradio-app/gradio version 4.21.0, specifically within the `/queue/join` endpoint and the `save_url_to_cache` function. The vulnerability arises when the `path` value, obtained from the user and expected to be a URL, is used to make an HTTP request without sufficient validation checks. This flaw allows an attacker to send crafted requests that could lead to unauthorized access to the local network or the AWS metadata endpoint, thereby compromising the security of internal servers.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://huntr.com/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88; https://huntr.com/bounties/b34f084b-7d14-4f00-bc10-048a3a5aaf88
CVE: CVE-2024-4889
Published: 2024-06-06
Description: A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can write a malicious Google KMS configuration file to the `cached_logo.jpg` file. This file can then be used to execute arbitrary code by assigning malicious code to the `SAVE_CONFIG_TO_DB` environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8; https://huntr.com/bounties/be3fda72-a65b-4993-9a0e-7e0f05db51f8
CVE: CVE-2024-4941
Published: 2024-06-06
Description: A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the `postprocess()` function within `gradio/components/json_component.py`, where a user-controlled string is parsed as JSON. If the parsed JSON object contains a `path` key, the specified file is moved to a temporary directory, making it possible to retrieve it later via the `/file=..` endpoint. This issue is due to the `processing_utils.move_files_to_cache()` function traversing any object passed to it, looking for a dictionary with a `path` key, and then copying the specified file to a temporary directory. The vulnerability can be exploited by an attacker to read files on the remote system, posing a significant security risk.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c; https://huntr.com/bounties/39889ce1-298d-4568-aecd-7ae40c2ca58e; https://github.com/gradio-app/gradio/commit/ee1e2942e0a1ae84a08a05464e41c8108a03fa9c
CVE: CVE-2024-5127
Published: 2024-06-06
Description: In lunary-ai/lunary versions 1.2.2 through 1.2.25, an improper access control vulnerability allows users on the Free plan to invite other members and assign them any role, including those intended for Paid and Enterprise plans only. This issue arises due to insufficient backend validation of roles and permissions, enabling unauthorized users to join a project and potentially exploit roles and permissions not intended for their use. The vulnerability specifically affects the Team feature, where the backend fails to validate whether a user has paid for a plan before allowing them to send invite links with any role assigned. This could lead to unauthorized access and manipulation of project settings or data.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297; https://huntr.com/bounties/719a5db3-f943-4100-a660-011cadf1bb32; https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297
CVE: CVE-2024-5256
Published: 2024-06-06
Description: Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in an integer underflow before reading from memory. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22336.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-191, CWE-191
References: https://www.zerodayinitiative.com/advisories/ZDI-24-542/; https://www.zerodayinitiative.com/advisories/ZDI-24-542/
CVE: CVE-2024-5267
Published: 2024-06-06
Description: Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22384.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-543/; https://www.zerodayinitiative.com/advisories/ZDI-24-543/
CVE: CVE-2024-5268
Published: 2024-06-06
Description: Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-22428.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125, CWE-125
References: https://www.zerodayinitiative.com/advisories/ZDI-24-544/; https://www.zerodayinitiative.com/advisories/ZDI-24-544/
CVE: CVE-2024-5269
Published: 2024-06-06
Description: Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of SMB2 messages. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-22459.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416, CWE-416
References: https://www.zerodayinitiative.com/advisories/ZDI-24-545/; https://www.zerodayinitiative.com/advisories/ZDI-24-545/
CVE: CVE-2024-5277
Published: 2024-06-06
Description: In lunary-ai/lunary version 1.2.4, a vulnerability exists in the password recovery mechanism where the reset password token is not invalidated after use. This allows an attacker who compromises the recovery token to repeatedly change the password of a victim's account. The issue lies in the backend's handling of the reset password process, where the token, once used, is not discarded or invalidated, enabling its reuse. This vulnerability could lead to unauthorized account access if an attacker obtains the recovery token.
CVSS Score: 7.5 (HIGH)
CWE: CWE-640, CWE-640
References: https://huntr.com/bounties/6aaba769-d99c-48cf-90d2-7abad984213d; https://huntr.com/bounties/6aaba769-d99c-48cf-90d2-7abad984213d
CVE: CVE-2024-5301
Published: 2024-06-06
Description: Kofax Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22917.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-546/; https://www.zerodayinitiative.com/advisories/ZDI-24-546/
CVE: CVE-2024-5302
Published: 2024-06-06
Description: Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22918.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-547/; https://www.zerodayinitiative.com/advisories/ZDI-24-547/
CVE: CVE-2024-5303
Published: 2024-06-06
Description: Kofax Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of PSD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write  past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22919.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.zerodayinitiative.com/advisories/ZDI-24-548/; https://www.zerodayinitiative.com/advisories/ZDI-24-548/
CVE: CVE-2024-5452
Published: 2024-06-06
Description: A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Delta` objects to modify application state based on frontend actions. However, it is possible to bypass the intended restrictions on modifying dunder attributes, allowing an attacker to construct a serialized delta that passes the deserializer whitelist and contains dunder attributes. When processed, this can be exploited to access other modules, classes, and instances, leading to arbitrary attribute write and total RCE on any self-hosted pytorch-lightning application in its default configuration, as the delta endpoint is enabled by default.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-915, CWE-913
References: https://github.com/lightning-ai/pytorch-lightning/commit/330af381de88cff17515418a341cbc1f9f127f9a; https://huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da; https://huntr.com/bounties/486add92-275e-4a7b-92f9-42d84bc759da
CVE: CVE-2024-5482
Published: 2024-06-06
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version. The vulnerability arises because the application does not adequately validate URLs entered by users, allowing them to input arbitrary URLs, including those that target internal resources such as 'localhost' or '127.0.0.1'. This flaw enables attackers to make unauthorized requests to internal or external systems, potentially leading to access to sensitive data, service disruption, network integrity compromise, business logic manipulation, and abuse of third-party resources. The issue is critical and requires immediate attention to maintain the application's security and integrity.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-918
References: https://huntr.com/bounties/d97e23e7-172f-4862-a732-86bfc0b7860e; https://huntr.com/bounties/d97e23e7-172f-4862-a732-86bfc0b7860e
CVE: CVE-2024-5505
Published: 2024-06-06
Description: NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System. Authentication is required to exploit this vulnerability.

The specific flaw exists within the UpLoadServlet class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-22724.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.zerodayinitiative.com/advisories/ZDI-24-563/; https://www.zerodayinitiative.com/advisories/ZDI-24-563/
CVE: CVE-2024-5506
Published: 2024-06-06
Description: Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22514.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.keyshot.com/csirt/; https://www.zerodayinitiative.com/advisories/ZDI-24-538/; https://www.keyshot.com/csirt/
CVE: CVE-2024-5507
Published: 2024-06-06
Description: Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22266.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://www.keyshot.com/csirt/; https://www.zerodayinitiative.com/advisories/ZDI-24-541/; https://www.keyshot.com/csirt/
CVE: CVE-2024-5508
Published: 2024-06-06
Description: Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of KSP files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22267.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.keyshot.com/csirt/; https://www.zerodayinitiative.com/advisories/ZDI-24-539/; https://www.keyshot.com/csirt/
CVE: CVE-2024-5509
Published: 2024-06-06
Description: Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of BIP files. The issue results from loading a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-22738.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427, CWE-427
References: https://www.keyshot.com/csirt/; https://www.zerodayinitiative.com/advisories/ZDI-24-540/; https://www.keyshot.com/csirt/
CVE: CVE-2023-45192
Published: 2024-06-06
Description: IBM Engineering Requirements Management DOORS Next 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  268758.
CVSS Score: 8.2 (HIGH)
CWE: CWE-611
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/268758; https://www.ibm.com/support/pages/node/7156492; https://exchange.xforce.ibmcloud.com/vulnerabilities/268758
CVE: CVE-2024-0520
Published: 2024-06-06
Description: A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposition` header or the URL path is used to generate the final file path without proper sanitization. This flaw enables an attacker to control the file path fully by utilizing path traversal or absolute path techniques, such as '../../tmp/poc.txt' or '/tmp/poc.txt', leading to arbitrary file write. Exploiting this vulnerability could allow a malicious user to execute commands on the vulnerable machine, potentially gaining access to data and model information. The issue is fixed in version 2.9.0.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d; https://huntr.com/bounties/93e470d7-b6f0-409b-af63-49d3e2a26dbc; https://github.com/mlflow/mlflow/commit/400c226953b4568f4361bc0a0c223511652c2b9d
CVE: CVE-2024-1873
Published: 2024-06-06
Description: parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0. The endpoint improperly handles file paths, allowing attackers to specify absolute paths when interacting with the `DiscussionsDB` instance. This flaw enables attackers to create directories anywhere on the system where the application has permissions, potentially leading to denial of service by creating directories with names of critical files, such as HTTPS certificate files, causing server startup failures. Additionally, attackers can manipulate the database path, resulting in the loss of client data by constantly changing the file location to an attacker-controlled location, scattering the data across the filesystem and making recovery difficult.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-22
References: https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8; https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d; https://huntr.com/bounties/c1cfc0d9-517a-4d0e-bf1c-6444c1fd195d
CVE: CVE-2024-1880
Published: 2024-06-06
Description: An OS command injection vulnerability exists in the MacOS Text-To-Speech class MacOSTTS of the significant-gravitas/autogpt project, affecting versions up to v0.5.0. The vulnerability arises from the improper neutralization of special elements used in an OS command within the `_speech` method of the MacOSTTS class. Specifically, the use of `os.system` to execute the `say` command with user-supplied text allows for arbitrary code execution if an attacker can inject shell commands. This issue is triggered when the AutoGPT instance is run with the `--speak` option enabled and configured with `TEXT_TO_SPEECH_PROVIDER=macos`, reflecting back a shell injection snippet. The impact of this vulnerability is the potential execution of arbitrary code on the instance running AutoGPT. The issue was addressed in version 5.1.0.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://github.com/significant-gravitas/autogpt/commit/26324f29849967fa72c207da929af612f1740669; https://huntr.com/bounties/4e[PII_REDACTED]-4f3c-9634-3eaf33d6d58e; https://github.com/significant-gravitas/autogpt/commit/26324f29849967fa72c207da929af612f1740669