CVE-2023-5675

A flaw was found in Quarkus. When a Quarkus RestEasy Classic or Reactive JAX-RS endpoint has its methods declared in the abstract Java class or customized by Quarkus extensions using the annotation processor, the authorization of these methods will not be enforced if it is enabled by either...

Progress Software Telerik Reporting ObjectReader Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Progress Software Telerik Reporting. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists withi...

PT-2024-40702 · Oracle · Java

Name of the Vulnerable Software and Affected Versions: Java affected versions not specified Description: A security exception occurs in the JavaLanguageParser statement, specifically in the com.puppycrawl.tools.checkstyle.grammar.java package. The issue involves the weakCompareAndSetInt and...

SUSE-SU-2024:1345-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2024-24549: Fixed denial of service during header validation for HTTP/2 stream bsc1221386 - CVE-2024-23672: Fixed denial of service due to malicious WebSocket client keeping connection open bsc1221385 Other fixes: - Update to Tomcat 9.0.87...

The vulnerability of the Class of Service daemon (cosd) in Juniper Networks’ Junos OS-based network devices of the MX series allows a attacker to cause service interruptions.

The vulnerability of the Class of Service daemon cosd in Juniper Networks’ Junos OS operating systems and MX series network devices is related to the process slowdown of the MGD Management Gateway Daemon when processing commands. Exploiting this vulnerability can allow a malicious actor to cause...

Code Injection

llama-index-core is vulnerable to Code Injection. The vulnerability is due to insufficient input validation within the safeeval function in the executils class, which allows an attacker to bypass method restrictions resulting in unauthorized code execution...

CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...

CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio

An issue was discovered in gradio-app/gradio, where the /componentserver endpoint improperly allows the invocation of any method on a Component class with attacker-controlled arguments. Specifically, by exploiting the moveresourcetoblockcache method of the Block class, an attacker can copy any fi...

PT-2024-10474

Name of the Vulnerable Software and Affected Versions sqlparse affected versions not specified Description The issue is related to the sqlparse.parse function, which can lead to a Denial of Service due to a RecursionError when processing a heavily nested list. This can be exploited by a remote...

Infinite loop

Overview BouncyCastle is a C implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service. Remediation There is ...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in ED25519 verification in the ScalarUtil class. An attacker can send a malicious signature and public key to trigger denial of service. Remediation Upgrade BouncyCastle.Cryptography to version 2.3.1 or higher. References ...

CVE-2024-30382

An Improper Handling of Exceptional Conditions vulnerability in the routing protocol daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows a network-based, unauthenticated attacker to send a specific routing update, causing an rpd core due to memory corruption, leading to a Denial o...

Denial Of Service (DoS)

Xpdf is vulnerable to Denial of Service DoS. The vulnerability is due to the TextLine class mishandling characters with large y coordinates, potentially leading to a Denial of Service DoS or other unspecified impacts...

CVE-2021-47192

CVE-2021-47192 is a Linux kernel vulnerability in the scsi/core sysfs path that caused a hang/deadlock when a device state is changed via sysfs after iSCSI recovery. The root cause described in connected advisories is that rescan was invoked with state_mutex still held, leading to scsi_host_in_re...

CVE-2021-47192 scsi: core: sysfs: Fix hang when device state is set via sysfs

In the Linux kernel, the following vulnerability has been resolved: scsi: core: sysfs: Fix hang when device state is set via sysfs This fixes a regression added with: commit f0f82e2476f6 "scsi: core: Fix capacity set to zero after offlinining device" The problem is that after iSCSI recovery, iscs...

GHSA-WVPX-G427-Q9WC llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...

CVE-2024-3098

A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...

CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index

A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...

CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index

A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...

XWiki Platform 安全漏洞

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating Web collaboration applications. A security vulnerability exists in XWiki Platform that stems from the creation of documents using specially crafted document references and the XWiki.SchedulerJobClass XObject, which allo...