CVE-2024-4901

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes.

CVSS 3.1 · 8.7 High EPSS 33.5% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2024-4890

Blind SQL Injection in berriai/litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Litellm

Products

Litellm

CVE-2024-4889

Code Injection in berriai/litellm

A code injection vulnerability exists in the berriai/litellm application, version 1.34.6, due to the use of unvalidated input in the eval function within the secret management system. This vulnerability requires a valid Google KMS configuration file to be exploitable. Specifically, by setting the `UI_LOGO_PATH` variable to a remote server address in the `get_image` function, an attacker can write a malicious Google KMS configuration file to the `cached_logo.jpg` file. This file can then be used to execute arbitrary code by assigning malicious code to the `SAVE_CONFIG_TO_DB` environment variable, leading to full system control. The vulnerability is contingent upon the use of the Google KMS feature.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Litellm

Products

Litellm

CVE-2024-4888

Arbitrary File Deletion in BerriAI/litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Berriai Litellm

Products

Litellm Litellm

CVE-2024-4884

WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The Apm.UI.Areas.APM.Controllers.CommunityController allows execution of commands with iisapppool\nmconsole privileges.

CVSS 3.1 · 9.8 Critical EPSS 24.3% KEV · Not listed

Vendors

Progress

Products

Whatsup Gold

CVE-2024-4883

WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

CVSS 3.1 · 9.8 Critical EPSS 64.5% KEV · Not listed

Vendors

Progress

Products

Whatsup Gold

CVE-2024-4881

Path Traversal in parisneo/lollms

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read any file on the Windows system. Specifically, the application fails to adequately sanitize file paths containing backslashes (`\`), which can be exploited to access the root directory and read, or even delete, sensitive files. This issue was discovered in the context of the `/user_infos` endpoint, where a crafted request using backslashes to reference a file (e.g., `\windows\win.ini`) could result in unauthorized file access. The impact of this vulnerability includes the potential for attackers to access sensitive information such as environment variables, database files, and configuration files, which could lead to further compromise of the system.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Lollms

Products

Lollms

CVE-2024-4851

SSRF Vulnerability in stangirard/quivr

A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Quivr

Products

Quivr

CVE-2024-4755

Google CSE <= 1.0.7 - Admin+ Stored XSS

The Google CSE WordPress plugin through 1.0.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Erikeng

Products

Google Cse

CVE-2024-4753

WP Secure Maintenance < 1.7 - Admin+ Stored XSS

The WP Secure Maintenance WordPress plugin before 1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wpexperts

Products

Wp Secure Maintenance

CVE-2024-4748

RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server.  The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which would send such a malicious request to the locally launched server.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed

Vendors

Cruddiy J11g

Products

Cruddiy Cruddiy

CVE-2024-4708

mySCADA myPRO Use of Hard-coded Password

mySCADA myPRO uses a hard-coded password which could allow an attacker to remotely execute code on the affected device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Myscada

Products

Mypro

CVE-2024-4704

Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect

The Contact Form 7 WordPress plugin before 5.9.5 has an open redirect that allows an attacker to utilize a false URL and redirect to the URL of their choosing.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rocklobster

Products

Contact Form 7

CVE-2024-4680

Insufficient Session Expiration in zenml-io/zenml

A vulnerability in zenml-io/zenml version 0.56.3 allows attackers to reuse old session credentials or session IDs due to insufficient session expiration. Specifically, the session does not expire after a password change, enabling an attacker to maintain access to a compromised account without the victim's ability to revoke this access. This issue was observed in a self-hosted ZenML deployment via Docker, where after changing the password from one browser, the session remained active and usable in another browser without requiring re-authentication.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Zenml

Products

Zenml

CVE-2024-4664

WP Chat App < 3.6.5 - Admin+ Stored XSS

The WP Chat App WordPress plugin before 3.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ninjateam

Products

Wp Chat App

CVE-2024-4660

Missing Authorization in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gitlab

Products

Gitlab

CVE-2024-4655

Ultimate Blocks < 3.1.9 - Contributor+ Stored XSS

The Ultimate Blocks WordPress plugin before 3.1.9 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Dotcamp

Products

Ultimate Blocks

CVE-2024-4641

OnCell G3470A-LTE Series: Authenticated Format String Errors

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to accepting a format string from an external source as an argument. An attacker could modify an externally controlled format string to cause a memory leak and denial of service.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Oncell G3470a-lte-eu Oncell G3470a-lte-eu-t Oncell G3470a-lte-eu-t Firmware and 5 more

CVE-2024-4640

OnCell G3470A-LTE Series: Authenticated Command Injection via sendTestEmail

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to missing bounds checking on buffer operations. An attacker could write past the boundaries of allocated buffer regions in memory, causing a program crash.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Oncell G3470a-lte-eu Oncell G3470a-lte-eu-t Oncell G3470a-lte-eu-t Firmware and 5 more

CVE-2024-4639

OnCell G3470A-LTE Series: Authenticated Command Injection via webDelIPSec

OnCell G3470A-LTE Series firmware versions v1.7.7 and prior have been identified as vulnerable due to a lack of neutralized inputs in IPSec configuration. An attacker could modify the intended commands sent to target functions, which could cause malicious users to execute unauthorized commands.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Oncell G3470a-lte-eu Oncell G3470a-lte-eu-t Oncell G3470a-lte-eu-t Firmware and 5 more