CVE-2024-47868

CVE-2024-47868 affects Gradio, an open‑source Python library. A data validation vulnerability in post-processing steps can leak arbitrary files via several components that handle file data, including: String to FileData (DownloadButton, Audio, ImageEditor, Video, Model3D, File, UploadButton), Com...

PYSEC-2024-197

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal through the post-processing step. An attacker can expose sensitive files by crafting requests that bypass expected input...

Gradio has several components with post-process steps allow arbitrary file leaks

Impact What kind of vulnerability is it? Who is impacted? This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input...

Malware in hilla-components-dependencies

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Ubuntu: Security Advisory (USN-7042-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

dotnet: Multiple .NET components susceptible to hash flooding

A flaw was found in dotnet. The System.Security.Cryptography.Cose, System.IO.Packaging and System.Runtime.Caching components may be exposed to hostile input, making them susceptible to hash flooding attacks, resulting in denial of service...

dotnet: Multiple .NET components susceptible to hash flooding

A flaw was found in dotnet. The System.Security.Cryptography.Cose, System.IO.Packaging and System.Runtime.Caching components may be exposed to hostile input, making them susceptible to hash flooding attacks, resulting in denial of service...

CVE-2024-43551

Windows Storage Elevation of Privilege Vulnerability...

CVE-2024-7612: Incorrect Permission Assignment for Critical Resource

Insecure permissions in Ivanti EPMM before 12.1.0.4 allow a local authenticated attacker to modify sensitive application components...

PT-2024-38452 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPMM versions prior to 12.1.0.4 Description: Insecure permissions in Ivanti EPMM allow a local authenticated attacker to modify sensitive application components or access and modify sensitive configuration files without proper...

Microsoft Windows Print Spooler Components Security Vulnerabilities

Microsoft Windows Print Spooler Components is a printing backend handler component from Microsoft Corporation USA. A security vulnerability exists in Microsoft Windows Print Spooler Components. An attacker could exploit the vulnerability to elevate privileges. The following products and editions...

MAL-2024-9090 Malicious code in hilla-components-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b10fa0be1901d7dc877afdf66a185a7450e3e75a9377cf32d1618128c64862a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hilla-components-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b10fa0be1901d7dc877afdf66a185a7450e3e75a9377cf32d1618128c64862a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NuGet Package 'Microsoft.ML.Mkl.Components' Detection

The remote host has a 'Microsoft.ML.Mkl.Components' with a Verified NuGet package status and is installed on the remote host. Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'...

MAL-2024-9069 Malicious code in @b2bneo/components-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1d577f52f10cee6de3de2dee9eb8d3d70fb94c04b41f3dfb93794409066d6c8 The OpenSSF Package Analysis project identified '@b2bneo/components-tabs' @ 1.3.0 npm as malicious. It is considered malicious because: - The...

Malicious code in @b2bneo/components-tabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a1d577f52f10cee6de3de2dee9eb8d3d70fb94c04b41f3dfb93794409066d6c8 The OpenSSF Package Analysis project identified '@b2bneo/components-tabs' @ 1.3.0 npm as malicious. It is considered malicious because: - The...

OCSP stapling bypass with GnuTLS

...

@automattic/jetpack-ai-client (>=0.1.5, <=0.16.1), @automattic/jetpack-components (>=0.41.2, <=0.56.0) +45 more potentially affected by CVE-2024-21489 via uplot (>=1.1.2, <=1.6.30)

uplot NPM version =1.1.2, =0.1.5, =0.41.2, =0.29.8, =0.11.2, =5.0.1-beta.0, =1.0.0, =0.0.2, =8.3.0-beta.1, =10.2.0-nightly.0238db42, =0.0.1-beta.4, =0.8.0, =0.0.1-preview1, =0.1.10, =0.14.0 and more Source cves: CVE-2024-21489 Source advisory: MEND:CVE-2024-21489...

Synology DiskStation Manager Path Traversal (CVE-2013-6987)

Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot in the 1 path parameter to filedelete.cgi or 2 folderpath parameter to...