SUSE CVE-2024-47870

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

PT-2024-32841 · Plane · Plane

Name of the Vulnerable Software and Affected Versions: Plane versions prior to 0.23.0 Description: The issue concerns an open-source project management tool that uses wildcard support to retrieve images from any hostname, potentially allowing an attacker to induce the server into performing...

PYSEC-2024-218

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

Race Condition

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Race Condition in the updaterootinconfig function. An attacker can redirect user traffic to a malicious server, potentially intercepting sensitive da...

Gradio has a race condition in update_root_in_config may redirect user traffic

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect use...

CVE-2024-8513

The QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsavepluginconfig function in all versions up to, and including, 4.1.0.0. This makes it possibl...

WordPress plugin QA Analytics 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

PT-2024-7510 · Nginx · Nginx-Ui

Name of the Vulnerable Software and Affected Versions: Nginx UI versions prior to 2.0.0-beta.36 Description: The issue is related to the configuration settings of the Nginx UI server, specifically the /api/configs directory, and is associated with weaknesses in the authorization procedure. This c...

PT-2024-39065 · WordPress · Qa Analytics – Web Analytics Tool With Heatmaps & Session Replay Across All Pages

Name of the Vulnerable Software and Affected Versions: QA Analytics – Web Analytics Tool with Heatmaps & Session Replay Across All Pages plugin for WordPress versions up to, and including, 4.1.0.0 Description: The issue is related to a missing capability check on the ajax save plugin config...

PT-2024-32800 · Unknown · @Backstage/Plugin-App-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-app-backend versions prior to 0.3.75 Description: The issue concerns the configuration supplied through APP CONFIG environment variables, where the visibility defined in the configuration schema is unexpectedly ignored. This...

CVE-2024-20441

A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This vulnerability is due to insufficient authorization controls on the affected REST API endpoint. An attacker could...

CVE-2024-20442

Cisco Nexus Dashboard exposes a REST API vulnerability due to insufficient authorization controls on certain endpoints. An authenticated, low-privileged, remote attacker could perform limited Administrator actions such as viewing portions of the web UI, generating config backups, or deleting tech...

CVE-2024-20442 Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls on some REST API endpoints. An attacker...

Ruijie Networks RG-NBS2009G-P 安全漏洞

The Ruijie Networks RG-NBS2009G-P is a network security product from China's Ruijie Networks Ruijie Networks that is commonly used as an enterprise-class network border firewall. A security vulnerability exists in Ruijie Networks RG-NBS2009G-P v.10.41P2 Release 9736 that originated from a...

PT-2024-8625 · Cisco · Cisco Ndfc

Name of the Vulnerable Software and Affected Versions: Cisco NDFC affected versions not specified Description: A vulnerability in a specific REST API endpoint of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to learn sensitive information on an affected device. This iss...

PT-2024-20279 · Ruijie · Ruijie Rg-Nbs2009G-P Rgos

Name of the Vulnerable Software and Affected Versions: Ruijie RG-NBS2009G-P RGOS version 10.41P2 Release9736 Description: An issue in Ruijie RG-NBS2009G-P RGOS allows a remote attacker to gain privileges via the "system/config menu.htm" endpoint. This issue enables a remote attacker to escalate...

Arbitrary Code Execution

Overview autogen is an A programming framework for agentic AI Affected versions of this package are vulnerable to Arbitrary Code Execution via the codeexecutionconfig function, due to being set to None instead of False by default. Remediation Upgrade autogen to version 0.3.0b1 or higher. Referenc...

Insecure initial password configuration issue in SEIKO EPSON Web Config

Overview Web Config is software that allows users to check the status and change the settings of SEIKO EPSON products, e.g., printers and scanners, via a web browser. In the initial setting no administrative password is set, and when a user connects the device and configures Web Config settings f...

CVE-2024-47295

CVE-2024-47295 affects SEIKO EPSON Web Config, where insecure initial password configuration allows a remote unauthenticated attacker to set an arbitrary password and operate the device with administrative privileges. Public sources describe the vulnerability in the Web Config software used by SE...

CVE-2024-47295

Insecure initial password configuration issue in SEIKO EPSON Web Config allows a remote unauthenticated attacker to set an arbitrary password and operate the device with an administrative privilege. As for the details of the affected versions, see the information provided by the vendor under...