CVE-2023-39326 vulnerabilities
Vulnerabilities for packages: cortex, slsa-verifier, hey, mage, influx, nsc, sonobuoy, docker-cli, k3d, prometheus-bind-exporter, metrics-server, aactl, ctop, gitlab-logger, oras, configmap-reload, docker-credential-ecr-login, cni-plugins, grpcurl, nri-discovery-kubernetes, kind, ip-masq-agent,...
5.3CVSS
7.2AI Score
0.001EPSS
GHSA-5F94-VHJQ-RPG8 vulnerabilities
Vulnerabilities for packages: cortex, slsa-verifier, hey, mage, influx, nsc, sonobuoy, docker-cli, k3d, prometheus-bind-exporter, metrics-server, aactl, ctop, gitlab-logger, oras, configmap-reload, docker-credential-ecr-login, cni-plugins, grpcurl, nri-discovery-kubernetes, kind, ip-masq-agent,...
7.5AI Score
GHSA-9F76-WG39-X86H vulnerabilities
Vulnerabilities for packages: cortex, slsa-verifier, hey, mage, influx, nsc, sonobuoy, docker-cli, k3d, prometheus-bind-exporter, metrics-server, aactl, ctop, gitlab-logger, oras, configmap-reload, docker-credential-ecr-login, cni-plugins, grpcurl, nri-discovery-kubernetes, kind, ip-masq-agent,...
7.5AI Score
CVE-2024-24783 vulnerabilities
Vulnerabilities for packages: consul, nri-mssql, kube-bench, crossplane, mage, caddy, nodetaint, aws-ebs-csi-driver, cue, prometheus-blackbox-exporter, temporal-ui-server, ytt, kor, kuberay-operator, petname, gatekeeper, nfs-subdir-external-provisioner, k8sgpt-operator, direnv,...
7.8AI Score
0.0004EPSS
CVE-2024-24785 vulnerabilities
Vulnerabilities for packages: consul, nri-mssql, kube-bench, crossplane, mage, caddy, nodetaint, aws-ebs-csi-driver, cue, prometheus-blackbox-exporter, temporal-ui-server, ytt, kor, kuberay-operator, petname, gatekeeper, nfs-subdir-external-provisioner, k8sgpt-operator, direnv,...
7.8AI Score
0.0004EPSS
GHSA-45X7-PX36-X8W8 vulnerabilities
Vulnerabilities for packages: consul, kubescape, nri-mssql, crossplane, prometheus-nats-exporter, caddy, istio-pilot-discovery, ollama, flux-source-controller, prometheus-blackbox-exporter, temporal-ui-server, ko, istio-cni, cloudflared, grpc-health-probe, gatekeeper,...
7.5AI Score
CVE-2024-24788 vulnerabilities
Vulnerabilities for packages: mkcert, kubescape, kube-bench, crossplane, mage, crane, prometheus-nats-exporter, caddy, aws-ebs-csi-driver, newrelic-nri-statsd, flux-source-controller, cue, tfsec, flux-notification-controller, ko, cloudflared, mods, petname, nfs-subdir-external-provisioner, direnv,....
6.5AI Score
0.0004EPSS
GHSA-236W-P7WF-5PH8 vulnerabilities
Vulnerabilities for packages: consul, mkcert, nri-mssql, kube-bench, crossplane, velero-plugin-for-csi, flux-source-controller, gpu-feature-discovery, grpc-health-probe, hivemind, flannel-cni-plugin, nvidia-container-toolkit, neuvector-dbgen, kubernetes, kots, nsc, sigstore-scaffolding, kind,...
7.5AI Score
GHSA-XW73-RW38-6VJC vulnerabilities
Vulnerabilities for packages: up, flux-image-reflector-controller, kubescape, slsa-verifier, gitsign, kubeflow-katib, crane, istio-pilot-discovery, kyverno, zarf, k9s, loki, aactl, ctop, skopeo, istio-pilot-agent, kubevela, k3s, bom, datadog-agent, tekton-pipelines, guac, flux-helm-controller,...
7.5AI Score
CVE-2023-45290 vulnerabilities
Vulnerabilities for packages: consul, nri-mssql, kube-bench, crossplane, mage, caddy, nodetaint, aws-ebs-csi-driver, cue, prometheus-blackbox-exporter, temporal-ui-server, ytt, kor, kuberay-operator, petname, gatekeeper, nfs-subdir-external-provisioner, k8sgpt-operator, direnv,...
6AI Score
0.0004EPSS
CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5
CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is...
7.5CVSS
7.8AI Score
0.732EPSS
CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5
CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is...
7.5CVSS
8.3AI Score
0.002EPSS
CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5
CVE-2023-44487 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is...
7.5CVSS
8.2AI Score
0.732EPSS
CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5
CVE-2023-39325 affecting package cert-manager for versions less than 1.11.2-5. A patched version of the package is...
7.5CVSS
7.8AI Score
0.002EPSS
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer...
EPSS
Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitrary files via the IEC61850 File Transfer...
7.1AI Score
EPSS
CVE-2024-34102 POC for CVE-2024-34102. A pre-authentication...
9.8CVSS
6.9AI Score
0.038EPSS
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoint Protector and Unify agent in the way that the EasyLock dependency is acquired from the server. An attacker with administrative access to the Endpoint...
8.1AI Score
EPSS
Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoint Protector and Unify agent in the way that the EasyLock dependency is acquired from the server. An attacker with administrative access to the Endpoint...
EPSS
Decoding OWASP – A Security Engineer’s Roadmap to Application Security
In a time where over 60% of data breaches are linked to software vulnerabilities and a single overlooked software vulnerability can expose sensitive data, the imperative of robust application security cannot be overstated. The 2023 IBM Security Cost of a Data Breach Report highlights that...
8.4AI Score
An Inside Look at The Malware and Techniques Used in the WordPress.org Supply Chain Attack
On Monday June 24th, 2024 the Wordfence Threat Intelligence team was made aware of the presence of malware in the Social Warfare repository plugin (see post Supply Chain Attack on WordPress.org Plugins Leads to 5 Maliciously Compromised WordPress Plugins). After adding the malicious code to our...
7.8AI Score
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability....
7.5CVSS
7.4AI Score
EPSS
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in...
7.3CVSS
EPSS
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in...
7.3CVSS
7.2AI Score
EPSS
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability....
7.5CVSS
EPSS
A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be.....
8.6CVSS
EPSS
A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be.....
8.6CVSS
8.7AI Score
EPSS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path....
9.1CVSS
EPSS
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this...
4.3CVSS
EPSS
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path....
9.1CVSS
9.4AI Score
EPSS
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this...
4.3CVSS
4.5AI Score
EPSS
A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and...
7.4CVSS
EPSS
A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and...
7.4CVSS
7.7AI Score
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: ...
8.4CVSS
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: ...
7.5CVSS
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: ...
8.4CVSS
7.7AI Score
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: ...
6.2CVSS
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: ...
7.5CVSS
7.2AI Score
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: ...
6.2CVSS
5.8AI Score
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: ...
8.4CVSS
7.7AI Score
EPSS
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: ...
8.4CVSS
EPSS
CVE-2024-5980 Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning
A vulnerability in the /v1/runs API endpoint of lightning-ai/pytorch-lightning v2.2.4 allows attackers to exploit path traversal when extracting tar.gz files. When the LightningApp is running with the plugin_server, attackers can deploy malicious tar.gz plugins that embed arbitrary files with path....
9.1CVSS
EPSS
CVE-2024-6139 Path Traversal in parisneo/lollms
A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio files to arbitrary locations on the system and enumerate file paths. The issue arises from improper validation of user-provided file paths in...
7.3CVSS
EPSS
CVE-2024-5936 Open Redirect in imartinez/privategpt
An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this...
4.3CVSS
EPSS
CVE-2024-5824 Path Traversal in parisneo/lollms
A path traversal vulnerability in the /set_personality_config endpoint of parisneo/lollms version 9.4.0 allows an attacker to overwrite the configs/config.yaml file. This can lead to remote code execution by changing server configuration properties such as force_accept_remote_access and...
7.4CVSS
EPSS
CVE-2024-6085 Path Traversal in parisneo/lollms
A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be.....
8.6CVSS
EPSS
CVE-2024-6250 Absolute Path Traversal in parisneo/lollms-webui
An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the open_file endpoint of lollms_advanced.py. The sanitize_path function with allow_absolute_path=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability....
7.5CVSS
EPSS
CVE-2023-38370 IBM Security Access Manager Docker information disclosure
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: ...
7.5CVSS
EPSS
CVE-2023-38368 IBM Security Access Manager Docker information disclosure
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: ...
6.2CVSS
EPSS
CVE-2023-38368 IBM Security Access Manager Docker information disclosure
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: ...
6.2CVSS
5.7AI Score
EPSS