GHSA-FMJH-F678-CV3X vulnerabilities

Vulnerabilities for packages: hydra-fips, weaviate, hydra...

CVE-2023-38976

An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: trivy, zarf, kiali, tekton-chains, step-issuer, spire-server, sftpgo, spire-controller-manager, frp, traefik, dagger, fulcio, vault-benchmark, grafana-mimir, flyte, neuvector-scanner, wolfictl, boring-registry, sftpgo-plugin-kms, podman, pulumi, melange, zot,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: trivy, zarf, kiali, tekton-chains, step-issuer, spire-server, sftpgo, spire-controller-manager, frp, traefik, dagger, fulcio, vault-benchmark, grafana-mimir, flyte, neuvector-scanner, wolfictl, boring-registry, sftpgo-plugin-kms, podman, pulumi, melange, zot,...

GHSA-WCJW-3V6P-4V3R MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

CVE-2024-45846

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

PYSEC-2024-77

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

PYSEC-2024-77

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

CVE-2024-45846

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

CVE-2024-45846

The CVE-2024-45846 entry describes an arbitrary code execution vulnerability in MindsDB versions 23.10.3.0 through 24.7.4.1 when the Weaviate integration is installed. A specially crafted SELECT WHERE clause containing Python code can be passed to an eval function and executed on the server, impa...

CVE-2024-45846

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

CVE-2024-45846

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

PT-2024-6371 · Mindsdb +1 · Mindsdb +1

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.3.0 through 24.7.4.1 Description: An arbitrary code execution issue exists when the Weaviate integration is installed on the server. If a specially crafted SELECT WHERE clause containing Python code is run against a...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: dgraph, guac, zarf, cloudflared, step-ca, tekton-chains, flux-kustomize-controller, gomplate, temporal, grpc-health-probe, argo-workflows, minio, spire-server, sops, tkn, rekor, dex, step, bank-vaults, cosign, frp, temporal-ui-server, fulcio, rook, skopeo, wolfictl,...

GO-2023-2017 Denial of service vulnerability in github.com/weaviate/weaviate

A type conversion issue in Weaviate may allow a remote attack that would cause a denial of service...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: aactl, volume-modifier-for-k8s-fips, spark-operator, timestamp-authority-fips, kubevela, kiam, metrics-server-fips, prometheus-adapter-fips, kubeflow, prometheus-blackbox-exporter, conftest-fips, kubescape, buildkitd, scorecard, terraform-provider-sendgrid-fips,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: dgraph, spark-operator, buildkitd, k3d, prometheus-blackbox-exporter, up, kubescape, terraform-provider-sendgrid, aactl, kubevela, kubeflow, src, scorecard, slsa-verifier, cortex...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: metacontroller, prometheus-adapter, ip-masq-agent, nginx-stable, mc, frp, haproxy-ingress, hugo, kind, pulumi, metrics-server, cue, sigstore-scaffolding, certificate-transparency, newrelic-infrastructure-agent, secrets-store-csi-driver, flux-kustomize-controller,...

Weaviate denial of service vulnerability

Impact This vulnerability is a type conversion issue that affects users of Weaviate Server versions 1.20.0 and earlier. Who is impacted: Users of Weaviate Server versions 1.20.0 and earlier are impacted by this vulnerability. Patches A patch has been developed for this vulnerability. Patch releas...