Everest Forms < 2.0.8 - Unauthenticated Server-Side Request Forgery via font_url

Description The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'fonturl' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify...

UBUNTU-CVE-2024-26540

A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimglibrary::CImg::loadanalyze...

CImg Security Vulnerabilities

CImg is a small open source C++ toolkit for image processing from GREYC Open Source. A security vulnerability exists in versions prior to Clmg 3.3.3. An attacker exploited this vulnerability to cause a heap-based buffer overflow via a specially crafted cimglibrary::CImg::loadanalyze file...

CVE-2024-26540

A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimglibrary::CImg::loadanalyze...

Design/Logic Flaw

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

PYSEC-2024-314

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

CVE-2024-28423

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

PYSEC-2024-263

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

PYSEC-2024-315

Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafeload function at cli.py. This vulnerability allows attackers to execute arbitrary code via uploading a crafted YML file...

Airflow-Diagrams Security Vulnerability

airflow-diagrams is a diagramming tool from the individual developer Felix Uellendall. A security vulnerability exists in Airflow-Diagrams version v2.1.0, which stems from the unsafeload function in cli.py containing an arbitrary file upload vulnerability that allows an attacker to execute...

Fortinet FortiPortal Authorization Issues Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. An authorization issue vulnerability exists in Fortinet FortiPortal that stems from the...

PT-2024-28073 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a null-pointer dereference in the libbpf component of the Linux kernel. Specifically, in the bpf objec load prog function, there is no guarantee that obj-btf is...

PT-2024-22426 · Unknown · Airflow-Diagrams

Name of the Vulnerable Software and Affected Versions: Airflow-Diagrams version 2.1.0 Description: The issue is related to an arbitrary file upload vulnerability in the unsafe load function at cli.py. This allows attackers to execute arbitrary code via uploading a crafted YML file. Recommendation...

CVE-2024-28424

ZenML v0.55.4 is affected by an arbitrary file upload vulnerability in the load function of /materializers/cloudpickle_materializer.py, enabling remote code execution via a crafted file. This vulnerability is described consistently across multiple feeds (NVD, Red Hat, OSV, Nessus/NASL, CVE lists)...

PT-2024-22428 · Greykite · Greykite

Name of the Vulnerable Software and Affected Versions: greykite version 1.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an arbitrary file upload vulnerability in the load obj function at /templates/pickle utils.py. Recommendations:...

CVE-2022-34321 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint

Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections...

OESA-2024-1262 stb security update

Single-file public domain libraries for C/C++. Security Fixes: stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it...

OESA-2024-1263 stb security update

Single-file public domain libraries for C/C++. Security Fixes: stbimage is a single file MIT licensed library for processing images. It may look like stbiloadgifmain doesn’t give guarantees about the content of output value delays upon failure. Although it sets delays to zero at the beginning, it...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...

CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits

The Apollo Router is a graph router written in Rust to run a federated supergraph that uses Apollo Federation. Versions 0.9.5 until 1.40.2 are subject to a Denial-of-Service DoS type vulnerability. When receiving compressed HTTP payloads, affected versions of the Router evaluate the...