221 matches found
Insertion of Sensitive Information into Externally-Accessible File or Directory
Overview nautobot-ssot is a Nautobot Single Source of Truth Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory by placing the Service Now public instance name e.g. companyname.service-now.com in a generic django view...
Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL
The servicenow config URL is using a generic django View with no authentication. URL: /plugins/ssot/servicenow/config/ Impact What kind of vulnerability is it? Who is impacted? An Unauthenticated attacker could access this page to view the Service Now public instance name e.g...
GHSA-535G-62R7-CX6V Nautobot Single Source of Truth (SSoT) has an unauthenticated ServiceNow configuration URL
The servicenow config URL is using a generic django View with no authentication. URL: /plugins/ssot/servicenow/config/ Impact What kind of vulnerability is it? Who is impacted? An Unauthenticated attacker could access this page to view the Service Now public instance name e.g...
EUVD-2020-29659
Malware in sbrugna...
EUVD-2025-17673
Malicious code in bioql PyPI...
EUVD-2025-24127
Malicious code in bioql PyPI...
PhpSpreadsheet 代码问题漏洞
PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. A code issue vulnerability exists in PhpSpreadsheet versions 1.30.0, 2.1.12, 2.4.0, 3.10.0, and prior to 5.0.0, which stems from a server-side request forgery during HTML document processing...
CVE-2025-8747
A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...
Duplicate Advisory: Keras safe mode bypass vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c9rc-mg46-23w3. This link is maintained to preserve external references. Original Description A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an...
GHSA-PWQ7-2GVJ-VG9V Duplicate Advisory: Keras safe mode bypass vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c9rc-mg46-23w3. This link is maintained to preserve external references. Original Description A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an...
CVE-2025-8747
A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...
PYSEC-2025-75
A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...
AZL-66171 CVE-2025-8747 affecting package keras for versions less than 3.3.3-3
A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...
CVE-2025-8747
CVE-2025-8747 corresponds to a safe-mode bypass in Keras Model.load_model, allowing arbitrary code execution by loading a crafted .keras archive. Connected IBM bulletins confirm the vulnerability affects Keras 3.0.0–3.10.0 and describe a bypass via manipulated config.json or inner Lambda mechanis...
CVE-2025-8747
A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted .keras model archive...
CVE-2025-49454
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in LoftOcean TinySalt tinysalt allows PHP Local File Inclusion.This issue affects TinySalt: from n/a through 3.10.0...
CVE-2025-49455
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboard allows Blind SQL Injection.This issue affects WordPress-WPJobBoard: from n/a through = 25.07010000-WP6.8.1-JB5.11.5...
CVE-2025-49455
CVE-2025-49455 affects LoftOcean TinySalt (WordPress Theme) prior to 3.10.0. The issue is described as a Deserialization of Untrusted Data vulnerability that enables Object Injection . The connected sources consistently identify TinySalt and specify the vulnerable version range as before 3.10.0, ...
