CVE-2025-34267 Flowise Authenticated Command Execution and Sandbox Bypass via Puppeteer & Playwright Packages

Flowise v3.0.1 3.0.8 and all versions after with 'ALLOWBUILTINDEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules Puppeteer and Playwright within the nodevm execution environment. An authenticated attacker...

CVE-2023-42443

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...

Arbitrary Code Execution

Overview smolagents is a 🤗 smolagents: a barebones library for agents. Agents write python code to call tools or orchestrate other agents. Affected versions of this package are vulnerable to Arbitrary Code Execution due to allowing access to Python builtins in localpythonexecutor.py, and only...

PYSEC-2024-186

RestrictedPython is a restricted execution environment for Python to run untrusted code. A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. The problem will be fixed in version 7.3. As a workaround, If the application...

Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Impact In certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. - For rawcall, the argument buffer of the call can be corrupted, leading to incorrect calldata in the sub-context. - For createfromblueprint and createcopyof, the buffer f...

CVE-2023-42443 Vyper vulnerable to memory corruption in certain builtins utilizing `msize`

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine EVM. In version 0.3.9 and prior, under certain conditions, the memory used by the builtins rawcall, createfromblueprint and createcopyof can be corrupted. For rawcall, the argument buffer of the call can be corrupted,...

PT-2023-28343 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.9 and prior Description: The memory used by the builtins raw call, create from blueprint, and create copy of can be corrupted under certain conditions, leading to incorrect calldata in the sub-context or deploying incorrect...

GHSA-4HG4-9MF5-WXXQ incorrect order of evaluation of side effects for some builtins

Impact The order of evaluation of the arguments of the builtin functions uint256addmod, uint256mulmod, ecadd and ecmul does not follow source order. • For uint256addmoda,b,c and uint256mulmoda,b,c, the order is c,a,b. • For ecadda,b and ecmula,b, the order is b,a. Note that this behaviour is...

vm2 注入漏洞

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. An injection vulnerability exists in vm2 3.9.17 and earlier versions, which stems from the fact that an attacker can ru...

SUSE CVE-2019-18276

An issue was discovered in disableprivmode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems th...

Design/Logic Flaw

Open Policy Agent OPA is an open source, general-purpose policy engine. The Rego compiler provides a deprecated WithUnsafeBuiltins function, which allows users to provide a set of built-in functions that should be deemed unsafe — and as such rejected — by the compiler if encountered in the...

PT-2022-23174 · Unknown · Open Policy Agent

Name of the Vulnerable Software and Affected Versions: Open Policy Agent OPA versions prior to 0.43.1 Description: The Rego compiler in Open Policy Agent OPA has a deprecated WithUnsafeBuiltins function that allows users to specify built-in functions to be rejected by the compiler. However, a...

Open Policy Agent 安全漏洞

Open Policy Agent is an open source, general-purpose policy engine that enables uniform, context-aware policy enforcement across the stack. A security vulnerability exists in Open Policy Agent OPA that stems from the use of the with keyword to bypass WithUnsafeBuiltins to emulate functions...

GHSA-8VJ2-VXX3-667W Arbitrary expression injection in Pillow

PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method ImageMath.eval"execexit". While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval, it did not prevent builtins available to lambda expression...

JavaLearnVulnerability

This is a Java vulnerability learning project repository, specifically focused on deserialization vulnerabilities. The repository contains a gadget called "URLDNS" which is used to verify if a target exists a deserialization vulnerability. The gadget is implemented using Java's built-in classes a...

Out-of-bounds

In Builtins::GenerateArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is n...

CVE-2021-0396

CVE-2021-0396: In Android, a bounds-check bug in Builtins::Generate_ArgumentsAdaptorTrampoline (builtins-arm.cc and related files) allows an out-of-bounds write, potentially enabling remote code execution in an unprivileged process with no privileges required and no user interaction. Affected: An...

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default if Bash is run with its effective UID not equal to its real UID it will drop privileges by setting its effective UID to its real UID. However it does so incorrectly. On Linux and other systems that support "saved UID" functionality the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin which can be a shared object that calls setuid() and therefore regains privileges. However binaries running with an effective UID of 0 are unaffected.

...

SUSE SLES12 Security Update : grub2 (SUSE-SU-2020:2076-1)

This update for grub2 fixes the following issues : Fix for CVE-2020-10713 bsc1168994 Fix for CVE-2020-14308 CVE-2020-14309, CVE-2020-14310, CVE-2020-14311 bsc1173812 Fix for CVE-2020-15706 bsc1174463 Fix for CVE-2020-15707 bsc1174570 Use overflow checking primitives where the arithmetic expressio...

CVE-2019-2208

In PromiseBuiltinsAssembler::NewPromiseCapability of builtins-promise.cc, there is a possible out of bounds read in v8 JIT code due to a bug in code generation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for...