4,914 results · Clear filters · Feed
-
Critical 9.3
External Control of File Name or Path in h2oai/h2o-3
External Control of File Name or Path in h2oai/h2o-3
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)
SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unau…
-
Critical 9.6
Path Traversal in mlflow/mlflow
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
-
Critical 9.8CVE-2023-50245 Public exploit
OpenEXR-viewer memory overflow vulnerability
OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.
-
Critical 10.0
Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
-
Critical 9.1
Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)
SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
-
Critical 9.8
Code execution in evershop
An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.
-
Critical 9.8
Apache Struts: File upload component had a directory traversal vulnerability
An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …
-
Critical 9.3
Improper Sanitization of Branch Name Leads to Arbitrary Code Injection
tj-actions/branch-names is a Github action to retrieve branch or tag names with support for all events. The `tj-actions/branch-names` GitHub Actions improperly references the `github.event.pull_request.head.ref` and `github.head_ref` context variables within …
-
Critical 9.8
HtmlUnit vulnerable to Remote Code Execution (RCE) via XSTL
HtmlUnit is a GUI-less browser for Java programs. HtmlUnit is vulnerable to Remote Code Execution (RCE) via XSTL, when browsing the attacker’s webpage. This vulnerability has been patched in version 3.9.0
-
Critical 9.8
Solon is vulnerable to Deserialization of Untrusted Data
Ssolon <= 2.6.0 and <=2.5.12 is vulnerable to Deserialization of Untrusted Data.
-
Critical 9.8
Microcks contains a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download
Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request.
-
Critical 9.8
Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request
A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.
-
Critical 9.8
RuoYi vulnerable to SQL injection vulnerability
RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
-
Critical 9.8
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in PHPMemcachedAdmin
A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files stored on the server due to lack of proper verification of user-supplied input.
-
Critical 9.8
Apache Cocoon's StreamGenerator is vulnerable to XXE injection
Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
-
Critical 9.8
Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.
-
Critical 9.1
October CMS safe mode bypass using Twig sandbox escape
October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to pro…
-
Critical 9.8
Ray has arbitrary code execution via jobs submission API
Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…
-
Critical 9.8
OwnCast remote code execution vulnerability
An issue in OwnCast v.0.1.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the authHost parameter of the indieauth function.
-
Critical 9.8
Authentication bypass using an empty token in capsule-proxy
capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a missing check if the user is authenticated based on the `TokenReview` result. All the clusters running…
-
Critical 9.1
SQL injection vulnerability in Meshery
A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary code through the “order” parameter
-
Critical 9.8
openssl npm package vulnerable to command execution
The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argument that contains a verb field (used for command execution). NOTE: This vulnerability only affects …
-
Critical 9.8
Apache Submarine: SQL injection from unauthorized login
Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fixed this issue and now user must have the correct login to access workbench. This issue affects Apac…
-
Critical 9.7
XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks
The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacke…
-
Critical 9.1
XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgery
XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actually unchanged image. For this, XWiki requests all embedded images on the server side. These request…
-
Critical 9.8
Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserialization
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 . Apache Submarine uses JAXRS to define REST endpoints. In order to handle YAML requests (using …
-
Critical 9.8
Apache Derby: LDAP injection vulnerability in authenticator
A cleverly devised username might bypass LDAP authentication checks. In LDAP-authenticated Derby installations, this could let an attacker fill up the disk by creating junk Derby databases. In LDAP-authenticated Derby installations, this could also allow the …
-
Critical —
Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file
### Impact Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-…
-
Critical 9.6
Liferay Portal XSS with `p_l_back_url_title` on edit content page
Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the `p_l_back_url_title` parameter.
-
Critical 9.8
Concrete CMS allows unauthorized access because directories can be created with insecure permissions
Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation functions (such as the Mkdir() function) gives universal access (0777) to created folders by default. Excess…
-
Critical 9.1
MLflow Authentication Bypass
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
-
Critical 10.0
MLflow Arbitrary File Write
An attacker can overwrite any file on the server hosting MLflow without any authentication.
-
Critical 9.3CVE-2023-6038 Scanner template
Local File Inclusion in h2oai/h2o-3
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation a…
-
Critical 9.8
Ray Command Injection in cpu_profile Parameter
A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here…
-
Critical 10.0
MLflow Arbitrary File Upload
MLflow allowed arbitrary files to be PUT onto the server.
-
Critical 9.1
piccolo SQL Injection via named transaction savepoints
Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all database implementations is vulnerable to SQL Injection via f-strings. While the likelihood of an e…
-
Critical 9.9
Improper Link Resolution Before File Access in froxlor/froxlor
Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0.
-
Critical 9.3
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and reflecting the response back to the user. This issue only affects users who have Next.js SDK tunnelin…