CVE-2024-43413

Xibo CMS prior to 4.1.0 is affected by an XSS vulnerability in the DataSet feature: allowing authorized users to execute JavaScript by crafting a DataSet HTML column that contains JavaScript. The JS runs on the Data Entry page and on any Layouts referencing that DataSet. In version 4.1.0 this beh...

CVE-2024-43413

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which...

PT-2024-30571

Name of the Vulnerable Software and Affected Versions Xibo versions prior to 4.1.0 Description A cross-site scripting issue in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. This occurs when a user designs a DataSet with an HTML column containing JavaScript,...

Xibo CMS 安全漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. A security vulnerability exists in Xibo CMS versions prior to 4.1.0, which stems from vulnerability to a cross-site scripting attack that allows authorized users to execute JavaScript via the DataSet function...

CVE-2024-43413: Improper Neutralization of Input During Web Page Generation

Xibo is an open source digital signage platform with a web content management system CMS. Prior to version 4.1.0, a cross-site scripting vulnerability in Xibo CMS allows authorized users to execute JavaScript via the DataSet functionality. Users can design a DataSet with a HTML column which...

Microsoft Azure ML.NET Samples mlnetfilestorage Uncontrolled Search Path Element Vulnerability

This vulnerability allows remote attackers to manipulate sample datasets on affected installations of ML.NET Samples for Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of ML.NET Samples. When installed from the...

CVE-2024-41804

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially...

CVE-2024-41804 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API route inside the CMS responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially...

CVE-2024-41804

CVE-2024-41804 affects Xibo CMS (DataSet Column Formulas API). An SQL injection vulnerability is exploitable by an authenticated user via the formula parameter, enabling access to/ modification of arbitrary data in the Xibo database. Remediation: upgrade to Xibo versions 3.3.12 or 4.0.14, which f...

PT-2024-29571 · Xibo · Xibo

Name of the Vulnerable Software and Affected Versions: Xibo versions prior to 3.3.12 Xibo versions prior to 4.0.14 Description: A SQL injection issue was discovered in the API route responsible for Adding/Editing DataSet Column Formulas. This allows an authenticated user to obtain and modify...

Xibo CMS SQL注入漏洞

Xibo CMS is an open source content management system from Xibo Digital Signage. Xibo CMS suffers from a SQL injection vulnerability that originates from allowing an authenticated user to view dataset data by injecting a specially crafted value into the API, which could allow an attacker to obtain...

Command Injection

deeplake is vulnerable to Command Injection. The vulnerability is due to a lack of input sanitization within the ingestkaggle API when ingesting a remote Kaggle dataset, allowing an attacker to execute arbitrary commands on the server...

CVE-2024-6507

CVE-2024-6507 relates to a command injection in the Deep Lake AI database when ingesting a remote Kaggle dataset, caused by insufficient input sanitization in the ingest_kaggle() API. The vulnerability is described across multiple sources (NVD/Red Hat/Veracode) with a high impact profile (CVSS v3...

CVE-2024-6507 Deep Lake Kaggle command injection

Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingestkaggle API...

PT-2024-37677 · Deeplake · Deeplake

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue is related to command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingest kaggle API. This allows for potential command injection...

CVE-2024-6507: Improper Neutralization of Special Elements used in an OS Command

Command injection when ingesting a remote Kaggle dataset due to a lack of input sanitization in the ingestkaggle API...

CVE-2024-37306 CVAT's export and backup-related API endpoints are susceptible to CSRF

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate a dataset export or a backup from a...

CVE-2024-37306

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate a dataset export or a backup from a...

Lunary Elevation of Privilege Vulnerability

lunary is lunary open source a production toolkit for LLM . An elevation of privilege vulnerability exists in lunary that stems from a lack of authorization checking and can be exploited by an attacker to delete any dataset...

CVE-2024-37306: Cross-Site Request Forgery (CSRF)

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. Starting in version 2.2.0 and prior to version 2.14.3, if an attacker can trick a logged-in CVAT user into visiting a malicious URL, they can initiate a dataset export or a backup from a...