12512 matches found
PT-2024-12379 · Unknown · Hypervisor
Name of the Vulnerable Software and Affected Versions: Hypervisor affected versions not specified Description: The issue involves a permanent denial of service DOS in the Hypervisor when an untrusted virtual machine VM without Power State Coordination Interface PSCI support makes a PSCI call. Thi...
The status of VDA machine was "Stopped" instead of "Stopped (Deallocated)" on Azure Portal
The following behavior was confirmed for dedicated machines created using Azure on-demand provisioning. - If shutdown the target VM within the OS, the status will be "Stopped" on Azure Portal. If it is "stopped", it will be subject to Azure pay-as-you-go billing. - If the target VM is from the...
CVE-2022-41761
An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files...
Denial Of Service (DOS)
QEMU virtual machine monitor is vulnerable to Denial Of Service DOS. The vulnerability is caused due to a DMA reentrancy issue leading to a use-after-free error found in the e1000e NIC emulation code. This can lead to a privileged guest user crash the QEMU process on the host, resulting in a Deni...
PYSEC-2023-249
Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of gradio prior to 4.11.0 contained a vulnerability in the /file route which made them susceptible to file traversal...
"The given key was not present in the dictionary" error when adding machine to machine catalog
"The given key was not present in the dictionary" error occurs when adding a machine to the machine catalog using the same name with that of a deleted VM. ---------------------------------------------------------------------------------------------- StudioErrorId : ExceptionThrown Reason :...
GHSA-3PJV-R7W4-2CF5 Grails data binding causes JVM crash and/or other denial of service
Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. Patches Patches are available for Grails 3 and later. Workarounds No workaround is possible except to avoid data binding to request data...
GHSA-HH8P-P8MP-GQHM MLFlow Path Traversal Vulnerability
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
CVE-2023-6975
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
Command injection
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
CVE-2023-6975 Path Traversal: '\..\filename'
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
CVE-2023-6975 Path Traversal: '\..\filename'
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
Grails Resource Management Error Vulnerability
Grails is a suite of open source frameworks for rapid web application development based on the Groovy programming language from the Grails project. Grails suffers from a resource management error vulnerability that originates from allowing an attacker to cause a denial of service DOS to the JVM v...
Mlflow Code Issue Vulnerability
Mlflow is an open source platform for machine learning lifecycle. Mlflow suffers from a code issue vulnerability. An attacker exploiting this vulnerability could remotely execute code on a victim computer...
CVE-2023-50466
An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute arbitrary code or access sensitive information via injecting a crafted payload into the HMI Name parameter...
Malicious code in fgrav (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 260f4b9823b4fdb4f4a442ef4822b86e3300331240bcd5288afe034380699df5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Weintek cMT security breach
Weintek cMT is a Human Machine Interface application from Weintek. A security vulnerability exists in Weintek cMT that stems from the presence of an authenticated command injection vulnerability that allows an attacker to execute arbitrary code or access sensitive information by injecting a craft...
We Asked ChatGPT for 2024 Cybersecurity Predictions but You Should Make These Resolutions Instead
By Caitlin Condon, Senior Manager, Vulnerability Research at Rapid7, and Christiaan Beek, Senior Director, Threat Analytics at Rapid7 It’s that time of year again — time for the annual tradition of cybersecurity predictions. Here at Rapid7 we’ve seen a whole lot of threats and exploited...
The vulnerability of the software for creating and managing graphical user interfaces in industrial automation systems like SCADA CONPROSYS HMI Systems lies in the use of a password hash instead of a password for authentication. This allows attackers to exploit this flaw to disclose sensitive information through a “man-in-the-middle” attack.
The vulnerability of the SCADA CONPROSYS HMI System lies in the use of a password hash instead of a plain-text password for authentication. Exploiting this vulnerability allows an attacker, operating remotely, to disclose sensitive information through a “man-in-the-middle” attack...
Gradio Command Injection Vulnerability
Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. Gradio suffers from a command injection vulnerability that stems from the application exposing sensitive information to unauthorized participants...