gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-3099 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-3099 Source advisory: OSV:GHSA-8F8Q-Q2J7-7J2M...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-2928 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-2928 Source advisory: OSV:GHSA-J46Q-5PXX-8VMW...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-0520 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-0520 Source advisory: OSV:GHSA-5Q6C-FFVG-XCM9...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-2928 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-2928 Source advisory: OSV:PYSEC-2024-242...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2024-0520 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2024-0520 Source advisory: OSV:PYSEC-2024-239...

CVE-2024-4941

A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the "postprocess" function within "gradio/components/jsoncomponent.py", where a user-controlled string is parsed as JSON. If the parsed...

springframework: URL Parsing with Host Validation

A flaw was found in the Spring Framework. Applications that use UriComponentsBuilder to parse an externally provided URL, for example, through a query parameter, and perform validation checks on the host of the parsed URL may be vulnerable to an open redirect attack or an SSRF attack if the URL i...

[SECURITY] Fedora 40 Update: qt5-qttools-5.15.14-1.fc40

Qt5 - QtTool components...

[SECURITY] Fedora 40 Update: qt5-qtwebkit-5.212.0-0.87alpha4.fc40

Qt5 - QtWebKit components...

[SECURITY] Fedora 40 Update: qt5-qtconnectivity-5.15.14-1.fc40

Qt5 - Connectivity components...

Unsafe Reflection in base Component class

Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...

Security Bulletin: Due to use of IBM® SDK Java™ Technology Edition, IBM Tivoli Monitoring (ITM) components is vulnerable to a local authenticated attacker to bypass security restrictions.

Summary A vulnerabilitiy in IBM® SDK Java™ Technology Edition that is shipped as part of multiple IBM Tivoli Monitoring ITM components. CVE-2024-3933 Vulnerability Details CVEID:CVE-2024-3933 DESCRIPTION: Eclipse Openj9 could allow a local authenticated attacker to bypass security restrictions,...

SUSE CVE-2024-36946

In the Linux kernel, the following vulnerability has been resolved: phonet: fix rtmphonetnotify skb allocation fillroute stores three components in the skb: - struct rtmsg - RTADST u8 - RTAOIF u32 Therefore, rtmphonetnotify should use NLMSGALIGNsizeofstruct rtmsg + nlatotalsize1 + nlatotalsize4...

Researchers Uncover RAT-Dropping npm Package Targeting Gulp Users

Cybersecurity researchers have uncovered a new suspicious package uploaded to the npm package registry that's designed to drop a remote access trojan RAT on compromised systems. The package in question is glup-debugger-log, which targets users of the gulp toolkit by masquerading as a "logger for...

PT-2024-40124

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue arises from the failure to properly encode editor input, making several frontend components susceptible to Cross-Site Scripting. This allows authenticated editors to inject...

Unsafe Reflection in base Component class in yiisoft/yii2

Yii2 supports attaching Behaviors to Components by setting properties having the format 'as '. Internally this is done using the set magic method. If the value passed to this method is not an instance of the Behavior class, a new object is instantiated using Yii::createObject$value. However, ther...

[SECURITY] Fedora 39 Update: plasma-workspace-5.27.11.1-1.fc39

Plasma 5 libraries and runtime components...

[SECURITY] Fedora 40 Update: plasma-workspace-6.0.5.1-1.fc40

Plasma 6 libraries and runtime components...

Cross-site Scripting (XSS)

Umbraco Commerce is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient validation allowing authenticated users with access to edit forms to inject unsafe code into form components...

CVE-2024-35239

Umbraco Commerce is an open source dotnet web forms solution. In affected versions an authenticated user that has access to edit Forms may inject unsafe code into Forms components. This issue can be mitigated by configuring TitleAndDescription:AllowUnsafeHtmlRendering after upgrading to one of th...