PT-2024-40924 · Pypi · Pyo3

Name of the Vulnerable Software and Affected Versions: PyO3 versions prior to 0.23 Description: The family of functions to read "borrowed" values from Python weak references were fundamentally unsound due to the weak reference not having ownership of the value. This could lead to a dangling...

GHSA-6G7W-8WPP-FRHJ Denial of Service Vulnerability in Rustls Library

Summary rustls::ConnectionCommon::completeio could fall into an infinite loop based on network input. Details Verified at 0.22 and 0.23 rustls, but 0.21 and 0.20 release lines are also affected. tokio-rustls and rustls-ffi do not call completeio and are not affected. rustls::Stream and...

CVE-2023-49773

Deserialization of Untrusted Data vulnerability in Tim Brattberg BCorp Shortcodes.This issue affects BCorp Shortcodes: from n/a through 0.23...

CVE-2023-39325 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure, pulumi-language-java, tekton-chains, k3s, azure-aad-pod-identity-mic, haproxy-ingress, falcoctl, aws-efs-csi-driver-fips, thanos-operator, secrets-store-csi-driver-provider-gcp, kubevela, kubernetes-csi-livenessprobe-fips, runc,...

Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs.

...

AZL-28094 CVE-2021-34193 affecting package opensc for versions less than 0.23.0-1

Stack overflow vulnerability in OpenSC smart card middleware before 0.23 via crafted responses to APDUs...

OpenSC 缓冲区错误漏洞

OpenSC is an open source smart card tool and middleware. A security vulnerability exists in OpenSC smart card middleware prior to version 0.23, which originates from a stack overflow that can be caused by a crafted APDU response...

GHSA-54W6-VXFH-FW7F Http4s improperly parses User-Agent and Server headers

Impact The User-Agent and Server header parsers are susceptible to a fatal error on certain inputs. In http4s, modeled headers are lazily parsed, so this only applies to services that explicitly request these typed headers. v0.21.x scala val unsafe: OptionUser-Agent = req.headers.getUser-Agent...

PT-2023-12250 · Opensc +1 · Opensc +1

Name of the Vulnerable Software and Affected Versions: OpenSC smart card middleware versions prior to 0.23 Description: A stack overflow issue exists in the OpenSC smart card middleware due to crafted responses to APDUs, which can lead to a stack overflow. Recommendations: For versions prior to...

PT-2020-6233 · P11 Kit +8 · P11-Kit +8

Name of the Vulnerable Software and Affected Versions: p11-kit versions 0.21.1 through 0.23.21 Description: A heap-based buffer over-read has been discovered in the RPC protocol used by the p11-kit server/remote commands and the client library. When the remote entity supplies a byte array through...

PYSEC-2020-107

DISPUTED scikit-learn aka sklearn through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load function is documented as unsafe and it is the...

Apache Superset Command Execution Vulnerability

Apache Superset is an enterprise-class business intelligence Web application from the Apache Apache Software Foundation in the United States. The program includes features such as mutual data visualization and enterprise-level authentication. A security vulnerability exists in Apache Superset...

PYSEC-2018-74

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...

CVE-2018-8021

Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation...