CVE-2024-41802 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain and modify arbitrary data from the Xibo database by injecting specially crafted values in to t...

CVE-2024-41802

Xibo CMS has a SQL injection vulnerability in the API routes that filter DataSets. An authenticated user can inject crafted values via the Import JSON and Import Layout DataSet APIs to read/modify data in the Xibo database. Affected software: Xibo CMS; vulnerability arises in DataSet filtering co...

CVE-2024-41803 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for...

CVE-2024-41803

Xibo CMS contains an SQL injection in the API routes that filter DataSets. The vulnerability, exploitable by an authenticated user, can allow extraction of arbitrary data from Xibo’s database. Affected versions are before 3.3.12 and before 4.0.14; remediation is to upgrade to 3.3.12 or 4.0.14, re...

CVE-2024-41803 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for...

CVE-2024-41803 Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter

Xibo is a content management system CMS. An SQL injection vulnerability was discovered in the API routes inside the CMS responsible for Filtering DataSets. This allows an authenticated user to to obtain arbitrary data from the Xibo database by injecting specially crafted values in to the API for...

Microsoft Azure SQL Workshop azuremlsampleexperiments Uncontrolled Search Path Element Vulnerability

This vulnerability allows remote attackers to manipulate sample datasets on affected installations of SQL Workshop for Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of SQL Workshop. When installed from the official...

streamlit-geospatial 安全漏洞

streamlit-geospatial is an Open Geospatial Solutions open source streamlit multi-page application for geospatial applications. A security vulnerability exists in streamlit-geospatial, which stems from pages/10? The visparams variable in EarthEngineDatasets.py accepts user input that is then used ...

PT-2024-29273 · Unknown · Streamlit-Geospatial

Name of the Vulnerable Software and Affected Versions: streamlit-geospatial versions prior to commit c4f81d9616d40c60584e36abb15300853a66e489 Description: The issue concerns the use of user input in the vis params variable, which is later executed by the eval function, leading to remote code...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Deep Lake Security Breach

Deep Lake is an AI database open-sourced by Activeloop. Its storage format is optimized for deep learning applications. A security vulnerability exists in Deep Lake version 3.9.10, which stems from a lack of input cleanup and command injection when extracting remote Kaggle datasets...

Insecure Deserialization

Ydataprofiling is vulnerable to Insecure Deserialization. This vulnerability is due to a lack of proper validation in the ydata-profiling library, allowing maliciously crafted datasets to execute arbitrary code on an end user's system when loaded...

CVE-2024-3761 Missing Authorization on Delete Datasets in lunary-ai/lunary

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at packages/backend/src/api/v1/datasets is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a datas...

PT-2024-27674 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions 1.2.2 through 1.2.7 Description: The issue is related to the DELETE endpoint located at packages/backend/src/api/v1/datasets, which is vulnerable to unauthorized dataset deletion due to missing authorization and...

CVE-2024-32664

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use...

CVE-2024-32664 Suricata's base64 contains an out of bounds write

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0.19, specially crafted traffic or datasets can cause a limited buffer overflow. This vulnerability is fixed in 7.0.5 and 6.0.19. Workarounds include not use...

Improper Authorization

apache-superset is vulnerable to Improper Authorization. The vulnerability is due to a user with custom roles that include can write on dataset which allows them to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to...

Apache Superset: Improper data authorization when creating a new dataset

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...

GHSA-WR6G-9WCR-CMQJ Apache Superset: Improper data authorization when creating a new dataset

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...

Code injection

Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data. This issue affects Apac...