CVE-2022-21129

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies...

CVE-2024-0081

NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asrwebapp where an attacker may cause an allocation of resources without limits or throttling. A successful exploit of this vulnerability may lead to a server-side denial of service...

bma (0.2.0a1), fiduswriter (>=4.0.0rc2, <=4.0.19) +2 more potentially affected by unknown CVE via django-allauth (>=65.0.0, <=65.2.0)

django-allauth PYPI version =65.0.0, =4.0.0rc2, =0.163.0, =2.0.0, =2.0.3 Source cves: unknown CVE Source advisory: SNYK:PYTHON-DJANGOALLAUTH-8600545...

NVIDIA NeMo SaveRestoreConnector Code Execution

The vulnerability of the SaveRestoreConnector function in NVIDIA NeMo’s comprehensive platform for training and applying neural networks in speech processing and natural language processing is related to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

CVE-2024-0129

CVE-2024-0129 affects NVIDIA NeMo, specifically the SaveRestoreConnector where unsafe extraction of .tar files can trigger a path traversal vulnerability. The issue may lead to code execution and data tampering. NVIDIA’s advisory patches NeMo up to version r2.0.0rc0; upgrading to this version (or...

CVE-2024-0129: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

NVIDIA NeMo security vulnerabilities

NVIDIA NeMo is a toolkit for building new state-of-the-art conversational Ai models from NVIDIA. A security vulnerability exists in NVIDIA NeMo that originates from a path traversal issue that may be caused by a user extracting from an insecure .tar file, which could lead to code execution and da...

Security Bulletin: NVIDIA NeMo - October 2024

NVIDIA has released a software update for NVIDIA® NeMo. To protect your system, download and install this software update from the Releases tab on the NeMo Github page. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update...

PT-2024-7979 · Nvidia · Nvidia Nemo

Name of the Vulnerable Software and Affected Versions: NVIDIA NeMo versions up to r2.0.0rc0 Description: The issue is related to the SaveRestoreConnector function in NVIDIA NeMo, which is associated with incorrect restriction of the directory path name with limited access. Exploitation of this...

arches (>=6.2.5, <=7.4.2), botbuilder-applicationinsights (>=0.0.1, <=4.14.8) +3 more potentially affected by CVE-2024-45231 via django (3.2.21)

django PYPI version 3.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =6.2.5, =0.0.1, =0.0.1, =2024.5.0, =2024.6.0 - nemo 4.6.4 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

nemo (>=1.22.0, <=1.22.1), patchman (>=1.2.3, <=1.2.4) potentially affected by CVE-2024-45231 via django (1.11.27)

django PYPI version 1.11.27 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - nemo =1.22.0, =1.2.3, =1.2.4 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

bugdoc (0.1.0), nemo (1.23.0) +1 more potentially affected by CVE-2024-45231 via django (1.11.28)

django PYPI version 1.11.28 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - bugdoc 0.1.0 - nemo 1.23.0 - pyxon 0.0.1 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

cheetay-logs (1.0.6), nemo (>=1.2.1, <=1.10.0) potentially affected by CVE-2024-45231 via django (1.11.15)

django PYPI version 1.11.15 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cheetay-logs 1.0.6 - nemo =1.2.1, =1.10.0 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

nemo (>=1.11.1, <=1.14.0), opencensus-ext-django (>=0.1.0, <=0.3.1) potentially affected by CVE-2024-45231 via django (1.11.20)

django PYPI version 1.11.20 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - nemo =1.11.1, =0.1.0, =0.3.1 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

kwikapi-django (>=0.2.6, <=0.2.8), nemo (>=1.14.4, <=1.21.1) +1 more potentially affected by CVE-2024-45231 via django (1.11.23)

django PYPI version 1.11.23 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - kwikapi-django =0.2.6, =1.14.4, =1.21.1 - pyblue 2022.8.1 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...

autogenerated-api (1.1.9), django-oscar-moysklad (>=0.2.4, <=0.2.5) +2 more potentially affected by CVE-2024-45231 via django (1.11.18)

django PYPI version 1.11.18 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autogenerated-api 1.1.9 - django-oscar-moysklad =0.2.4, =1.0.0b0, =1.0.0b1 Source cves: CVE-2024-45231 Source advisory: OSV:GHSA-RRQC-C2JX-6JGV...