CVE-2025-23042

Gradio Blocked Path ACL bypass vulnerability (CVE-2025-23042) arises from missing case normalization in file-path validation. On case-insensitive file systems (e.g., Windows/macOS), an attacker can circumvent ACLs by altering the letter case of a blocked path, potentially accessing restricted fil...

GHSA-J2JG-FQ62-7C3H Gradio Blocked Path ACL Bypass Vulnerability

Summary Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windo...

Improper Handling of Case Sensitivity

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to improper case normalization in the file path validation logic through the blockedpaths parameter of the...

Gradio Blocked Path ACL Bypass Vulnerability

Summary Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windo...

CVE-2024-52969

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...

oauth2-proxy -- Non-linear parsing of case-insensitive content

Golang reports: This update include security fixes: CVE-2024-45338: Non-linear parsing of case-insensitive content...

Report of Special Counsel Smith Volume 1

Special Counsel Jack Smith's January 2025 report concluded that former President Donald Trump engaged in a criminal effort to overturn the 2020 election results, including pressuring officials and inciting the January 6 Capitol riot. Smith asserted that sufficient evidence existed to convict Trum...

CVE-2025-23042: Improper Authorization

Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path. This...

CVE-2024-52969: Improper Neutralization of Special Elements used in an SQL Command

An Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability CWE-89 in FortiSIEM ersion 7.1.7 and below, version 7.1.0, version 7.0.3 and below, version 6.7.9 and below, 6.7.8, version 6.6.5 and below, version 6.5.3 and below, version 6.4.4 and below...

PT-2025-4788

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 5.6.0 Description Gradio's Access Control List ACL for file paths can be bypassed by altering the letter case of a blocked file or directory path due to the lack of case normalization in the file path validation logic...

PT-2025-2947 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: FortiSIEM versions 7.1.7 and below FortiSIEM versions 7.0.3 and below FortiSIEM versions 6.7.9 and below FortiSIEM versions 6.6.5 and below FortiSIEM versions 6.5.3 and below FortiSIEM versions 6.4.4 and below Description: The issue is relate...

Gradio authorization issue vulnerability

Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. An authorization issue vulnerability exists in Gradio versions prior to 5.6.0 that stems from a lack of normalization of the path validation logic...

GHSA-45V3-38PC-874V

creationtimestamp| type| source ---|---|--- 2025-01-13 21:43:43+00:00| seen| https://infosec.exchange/users/cve/statuses/113823227741082612 2025-01-13 22:10:36+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/1419...

CISA: Business Case for Security Infographic

System About Files News Vote Help | Services API Advertise Contact | Account Join Login ---|---|---...

Spring LDAP String Case Injection Unauthorized Access

The vulnerability of the String.toLowerCase and String.toUpperCase methods in the Spring LDAP project, which simplifies the handling of LDAP Lightweight Directory Access Protocol, is related to insufficient registration checks. Exploiting this vulnerability can allow an attacker operating remotel...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

Non-linear parsing of case-insensitive content in golang.org/x/net/html

...

CVE-2024-37372

The Permission Model assumes that any path starting with two backslashes \ has a four-character prefix that can be ignored, which is not always true. This subtle bug leads to vulnerable edge cases...

Important: Red Hat Security Advisory: OpenShift Virtualization 4.17.3 Images

Red Hat OpenShift Virtualization release 4.17.3 is now available with updates to packages and images that fix several bugs and add enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which...

Time-of-Check Time-of-Use (TOCTOU)

Apache Tomcat is vulnerable to a Time-of-Check Time-of-Use TOCTOU. The vulnerability is due to incomplete mitigation and improper handling of file path canonicalization on case-insensitive file systems when the default servlet write is enabled, which allows an attacker to exploit race conditions ...