gradio

51 results · Feed

• Medium 5.9
  CVE-2024-1729

  Timing Attack Vulnerability in gradio-app/gradio

  A timing attack vulnerability exists in the gradio-app/gradio repository, specifically within the login function in routes.py. The vulnerability arises from the use of a direct comparison operation (`app.auth[username] == password`) to validate user credentia…

  gradio-app gradio-app/gradio gradio PyPI
  Mar 29, 2024
• High 7.3
  CVE-2024-2206

  SSRF Vulnerability in gradio-app/gradio

  An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers can exploit this vulnerability by manipulating the `self.replica_urls` set through the `X-Direct-Url` header in request…

  gradio-app gradio-app/gradio gradio PyPI
  Mar 27, 2024
• Medium 4.3
  CVE-2024-1727

  CSRF Vulnerability in gradio-app/gradio

  A Cross-Site Request Forgery (CSRF) vulnerability in gradio-app/gradio allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an unauthorized file upload to the …

  gradio-app gradio-app/gradio gradio PyPI
  Mar 21, 2024
• High 7.5
  CVE-2024-0964

  LFI in Gradio

  A local file include could be remotely triggered in Gradio due to a vulnerable user-supplied JSON value in an API request.

  gradio-app gradio-app/gradio gradio PyPI
  Feb 5, 2024
• Medium 5.6
  CVE-2023-51449 Scanner template EPSS 28%

  Make the `/file` secure against file traversal attacks

  Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which…

  gradio-app gradio gradio PyPI
  Dec 22, 2023
• Critical 9.6
  CVE-2023-6572 Public exploit

  Command Injection in gradio-app/gradio

  Command Injection in GitHub repository gradio-app/gradio prior to main.

  gradio-app gradio-app/gradio gradio PyPI
  Dec 14, 2023
• Medium 4.8
  CVE-2023-41626

  Gradio arbitrary file upload vulnerability

  Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.

  gradio PyPI
  Sep 15, 2023
• High 7.3
  CVE-2023-34239

  Unfiltered paths in gradio

  Gradio is an open-source Python library that is used to build machine learning and data science. Due to a lack of path filtering Gradio does not properly restrict file access to users. Additionally Gradio does not properly restrict the what URLs are proxied. …

  gradio-app gradio gradio PyPI
  Jun 7, 2023
• Medium 5.4
  CVE-2023-25823

  Gradio contains Use of Hard-coded Credentials

  Gradio is an open-source Python library to build machine learning and data science demos and web applications. Versions prior to 3.13.1 contain Use of Hard-coded Credentials. When using Gradio's share links (i.e. creating a Gradio app and then setting `share=…

  gradio-app gradio gradio PyPI
  Feb 23, 2023
• High 8.8
  CVE-2022-24770

  Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

  `gradio` is an open source framework for building interactive machine learning models and demos. Prior to version 2.8.11, `gradio` suffers from Improper Neutralization of Formula Elements in a CSV File. The `gradio` library has a flagging functionality which …

  gradio-app gradio gradio PyPI
  Mar 17, 2022
• High 7.7
  CVE-2021-43831 Scanner template

  Files on the host computer can be accessed from the Gradio interface

  Gradio is an open source framework for building interactive machine learning models and demos. In versions prior to 2.5.0 there is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces. File paths are not restricted and users w…

  gradio-app gradio gradio PyPI
  Dec 15, 2021