CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737

The Apache StreamPark development and management environment is vulnerable to command injection in its Project module due to insufficient validation of input parameters during Maven compilation. Specifically, the application fails to intercept or verify the backtick (``) character. An attacker wi...

CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2023-52291

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2023-52291

The Apache StreamPark development and management environment is vulnerable to command injection in its "Project" module due to insufficient validation of Maven build arguments. Specifically, the "<" operator is not correctly processed, allowing an attacker to execute arbitrary commands (e.g., ...

CVE-2024-29737: Improper Neutralization of Special Elements used in a Command

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2023-52291: Improper Neutralization of Special Elements used in a Command

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

PT-2024-5250 · Apache · Apache Streampark

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions prior to 2.1.4 Description: The issue is related to incorrect handling of the character in the Project Module of Apache StreamPark, allowing remote attackers to execute arbitrary commands. The vulnerability can be...

PYSEC-2024-66

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

UBUNTU-CVE-2022-48863

In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsppipelinebuild dsppipelinebuild allocates dup pointer by kstrdupcfg, but then it updates dup variable by strsep&dup, "|". As a result when it calls kfreedup, the dup variable contains NULL. Found by...

SUSE-SU-2024:2495-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2023-52846: hsr: Prevent use after free in prpcreatetaggedframe bsc1225098. - CVE-2024-36904: tcp: Use refcountincnotzero in tcptwskunique bsc1225732. -...

PT-2024-28956

Name of the Vulnerable Software and Affected Versions dbt versions prior to 1.6.14 dbt versions prior to 1.7.14 dbt versions prior to 1.8.0 Description The issue allows a malicious package to override core components of dbt with harmful code when installed. This is due to the design of dbt, which...

CVE-2024-4224

An authenticated stored cross-site scripting XSS exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DEUN V7.61.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DEUN V71.0.1 Build 20240628...

CVE-2024-4224 TP-Link TL-SG1016DE XSS

An authenticated stored cross-site scripting XSS exists in the TP-Link TL-SG1016DE affecting version TL-SG1016DEUN V7.61.0.0 Build 20230616, which could allow an adversary to run JavaScript in an administrator's browser. This issue was fixed in TL-SG1016DEUN V71.0.1 Build 20240628...

elementary-flask (>=0.0.1.dev7, <=0.0.1.dev12), flarestack (2.4.2) +18 more potentially affected by CVE-2024-6345 via setuptools (62.0.0)

setuptools PYPI version 62.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - elementary-flask =0.0.1.dev7, =4.4.0a1, =3.0.1, =0.1.0, =0.12.0, =0.8.0, =1.4.0, =2.7.0, =2.13.0, =1.8.1, =0.3.1, =2.0.0a1, =3.3.0, =3.6.1...

abtests (>=0.0.1, <=0.0.2.1), scikit-build (0.4.0) potentially affected by CVE-2024-6345 via setuptools (28.3.0)

setuptools PYPI version 28.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - abtests =0.0.1, =0.0.2.1 - scikit-build 0.4.0 Source cves: CVE-2024-6345 Source advisory: OSV:GHSA-CX63-2MW6-8HW5...

scikit-build (0.2.0) potentially affected by CVE-2024-6345 via setuptools (25.0.0)

setuptools PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - scikit-build 0.2.0 Source cves: CVE-2024-6345 Source advisory: OSV:GHSA-CX63-2MW6-8HW5...

build-vocabulary (0.1.8) potentially affected by CVE-2024-6345 via setuptools (40.6.0)

setuptools PYPI version 40.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - build-vocabulary 0.1.8 Source cves: CVE-2024-6345 Source advisory: OSV:GHSA-CX63-2MW6-8HW5...