CVE-2025-62724 Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" TOCTOU attack when downloading zip files to access files outside of the OODALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all curre...

CVE-2025-62724 Open OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)

Open OnDemand is an open-source HPC portal. Prior to versions 4.0.8 and 3.1.16, users can craft a "Time of Check to Time of Use" TOCTOU attack when downloading zip files to access files outside of the OODALLOWLIST. This vulnerability impacts sites that use the file browser allowlists in all curre...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand versions prior to 4.0.8 and prior to 3.1.16, which stems from a TOCTOU attack that could lead to access to files other than...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand versions prior to 4.0.8 and prior to 3.1.16, which stems from the presence of a globally writable location in GEMPATH...

PT-2025-47607

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.0.8 Open OnDemand versions prior to 3.1.16 Description Open OnDemand packages create world writable locations in the GEM PATH prior to versions 4.0.8 and 3.1.16. This could allow unauthorized modification of...

PT-2025-47604

Name of the Vulnerable Software and Affected Versions Open OnDemand versions prior to 4.0.8 Open OnDemand versions prior to 3.1.16 Description Open OnDemand is an open-source HPC portal. Users can potentially exploit a “Time of Check to Time of Use” TOCTOU condition when downloading zip files,...

EUVD-2020-23790

Malware in sbrugna...

EUVD-2025-27479

Malicious code in bioql PyPI...

CVE-2025-58435

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

CVE-2025-58435

Open OnDemand is affected: versions prior to 3.1.15 and 4.0.7 fail to rotate the noVNC password when TurboVNC > 3.1.2. The underlying issue enables a user to hijack a session if they obtain a link to an active desktop and the other party is authenticated; impact is limited to authenticated use...

CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

PT-2025-36938

Name of the Vulnerable Software and Affected Versions: Open OnDemand versions prior to 3.1.15 Open OnDemand versions prior to 4.0.7 Description: Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password whe...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand versions prior to 3.1.15 and 4.0.7, which stems from improper password rotation and could lead to session hijacking...

CVE-2025-53636

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-53636

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-53636

Open OnDemand (Open Source HPC portal) is affected by a DoS vulnerability where flooding logs via the shell app can generate very large log files. Affected versions are prior to 3.1.14 and prior to 4.0.6. The issue stems from improper log handling and results in DoS to the Open OnDemand system. F...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

PT-2025-29283 · Unknown · Open Ondemand

Name of the Vulnerable Software and Affected Versions: Open OnDemand versions prior to 3.1.14 Open OnDemand versions prior to 4.0.6 Description: Open OnDemand, an open-source HPC portal, is susceptible to a denial-of-service DoS condition. By interacting with the shell application and generating...