PYSEC-2024-77

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

CVE-2024-45854

CVE-2024-45854 concerns MindsDB platform 23.10.3.0 and later, with a deserialization of untrusted data flaw that can let a maliciously uploaded ‘inhouse’ model execute arbitrary code on the server when a describe query is run. The connected documents confirm the affected product/version and the u...

CVE-2024-45852

The CVE-2024-45852 entry concerns MindsDB Platform (versions 23.3.2.0 and newer) and is caused by Deserialization of untrusted data. This vulnerability can allow a maliciously uploaded model to execute arbitrary code on the server when interacted with. Impact is high (CVE metrics show high confid...

CVE-2024-45851

An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePoint integration is installed on the server. For databases created with the SharePoint engine, an ‘INSERT’ query can be used for list item creation. If such a...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB versions 23.11.4.2 through 24.7.4.1, which stems from the presence of an arbitrary code execution vulnerability that is passed to the eval function and executed on the server if...

Siemens SIMATIC SCADA and PCS 7 systems Remote Code Execution Vulnerability

SIMATIC Information Server is used to report and visualize process data stored in SIMATIC process Historian, the SIMATIC PCS 7, SIMATIC WinCC, and SIMATIC PCS-neo long-term archiving system. It stores process values, alarms, and batch data from the production plant in its database and provides...

Remote Code Execution (RCE)

dtale is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling or validation of user input in the "Custom Filter" feature using the getstrarg method, allowing malicious code to be executed on the server...

CVE-2024-38236

DHCP Server Service Denial of Service Vulnerability...

CVE-2023-30755

A vulnerability has been identified in SIMATIC CP 1242-7 V2 incl. SIPLUS variants All versions V3.5.20, SIMATIC CP 1243-1 incl. SIPLUS variants All versions V3.5.20, SIMATIC CP 1243-1 DNP3 incl. SIPLUS variants All versions V3.5.20, SIMATIC CP 1243-1 IEC incl. SIPLUS variants All versions V3.5.20...

Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability

...

PT-2024-7668 · Siemens · Simatic Cp 1242-7 V2 +11

Name of the Vulnerable Software and Affected Versions: SIMATIC CP 1242-7 V2 incl. SIPLUS variants versions prior to V3.5.20 SIMATIC CP 1243-1 incl. SIPLUS variants versions prior to V3.5.20 SIMATIC CP 1243-1 DNP3 incl. SIPLUS variants versions prior to V3.5.20 SIMATIC CP 1243-1 IEC incl. SIPLUS...

Man D-Tale 跨站脚本漏洞

Man D-Tale is a pandas data structure visualization tool from Man. A cross-site scripting vulnerability exists in Man D-Tale versions prior to 3.14.1 that stems from vulnerability to remote code execution attacks and allows an attacker to run malicious code on the server...

ROS-20240910-01

A vulnerability in the HAProxy server software is related to entering an infinite loop when given certain input data. of certain inputs. Exploitation of the vulnerability could allow an attacker acting remotely, cause a denial of service...

Siemens SIMATIC 代码问题漏洞

SIMATIC CP 1242 and CP 1243 associated processors connect SIMATIC S7-1200 controllers to a wide area network WAN. They provide integrated security features such as firewalls, virtual private networks VPNs, and support for other data encryption protocols.SIMATIC HMI Panels are used for operator...

The vulnerability of the file loading function of the backup and recovery software for remote and cloud-based Veeam Service Provider Console (VSPC) customers allows a hacker to execute arbitrary code on the VSPC server.

The vulnerability of the file loading function of the backup and data recovery software for remote and cloud-based Veeam Service Provider Console VSPC involves unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code on the VSPC...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from contains a code injection vulnerability that allows a low-privileged user to overwrite files o...

UBUNTU-CVE-2024-45159

An issue was discovered in Mbed TLS 3.x before 3.6.1. With TLS 1.3, when a server enables optional authentication of the client, if the client-provided certificate does not have appropriate values in if keyUsage or extKeyUsage extensions, then the return value of mbedtlssslgetverifyresult would...

Aardvark-dns 资源管理错误漏洞

Aardvark-dns is a dns server from Containers open source. Aardvark-dns versions 1.12.0 and 1.12.1 have a resource management error vulnerability that stems from serial processing of TCP DNS queries, which can lead to a denial of service by Containers...

Oracle TNS Listener Checker

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle TNS Listener Checker', 'Description' = %q This module checks the server for vulnerabilities like TNS Poison. Module sends a server a packe...

Unauthorized Session Creation And Password Reset

github.com/mattermost/mattermost-server is vulnerable to Unauthorized Session Creation And Password Reset. The vulnerability is due to a lack of proper validation for remote/synthetic users due to a shared channel configuration. This allows attackers to create munged email addresses using shared...