CVE-2024-47172 Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. An attacker with a CVAT account may retrieve certain information about any project, task, job or membership resource on the CVAT instance. The information exposed in this way is the same as...

CVE-2024-47064 Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access t...

CVE-2024-47063 Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciously-constructed URL, they can initiate a...

CVE-2024-47063

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciously-constructed URL, they can initiate a...

CVE-2024-47063

CVAT (Computer Vision Annotation Tool) contains a stored XSS vulnerability via the quality report data endpoint. A malicious user with task-creation/edit permissions can lure another logged-in user to a crafted URL, potentially executing scripts in the victim’s browser. Affected versions are prio...

Malware in csm-installation-wizard

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in pod-financier-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9054 Malicious code in jquery-ui-smoothness (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbde2167eb940c597861a429b583a7e45ac7225bee0da328cc03ddbbcb363beb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47063: Improper Neutralization of Input During Web Page Generation

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. If a malicious CVAT user with permissions to either create a task, or edit an existing task can trick another logged-in user into visiting a maliciously-constructed URL, they can initiate a...

CVE-2024-47064: Improper Neutralization of Input During Web Page Generation

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. If an attacker can trick a logged-in CVAT user into visiting a maliciously-constructed URL, they can initiate any API calls on that user's behalf. This gives the attacker temporary access t...

Computer Vision Annotation Tool security vulnerabilities

Computer Vision Annotation Tool CVAT is a cvat.ai open source interactive video and image annotation tool for computer vision. A security vulnerability exists in Computer Vision Annotation Tool versions 2.0.0 through 2.19.0 that originates from an attacker with an account that can retrieve certai...

PT-2024-32382 · Unknown · Computer Vision Annotation Tool

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The issue allows an attacker to initiate API calls on behalf of a logged-in user if they can trick the user into visiting a maliciously-constructed URL. This gives the...

OpenCV utils.cpp Heap Buffer Overflow DoS

The vulnerability of the FillColorRow8 function in the utils.cpp component of the OpenCV library, which is used for computer vision, image processing, and general numerical algorithms, is related to buffer overflows. Exploiting this vulnerability could allow an attacker to gain access to...

SUSE CVE-2024-46843

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Remove SCSI host only if added If host tries to remove ufshcd driver from a UFS device it would cause a kernel panic if ufshcdasyncscan fails during ufshcdprobehba before adding a SCSI host with scsiaddhost and M...

Malicious code in meraki-react-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c83f2848053884da4ed2503526a13acf16087c512c728e406200da4b78084d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in font-lato-2-subset (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b613318a5c7aecc4baa2401877fcc8216636e03d2487ca00748977bca9763ae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9014 Malicious code in testdjallal-ui-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1743902cfe9e18cf0f325f256d6df25de8dbc811261f10d3c0f1861584e90b19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in them4on (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cf7aae5da80be4c617408e1862c8307fc970f6cbfdeac0d07c42d5694af6162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9015 Malicious code in them4on (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4cf7aae5da80be4c617408e1862c8307fc970f6cbfdeac0d07c42d5694af6162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in autocomplete-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd596b11e151bc765536ac31d81e6203896f3f04dbbf52913aa3b6f1fd2c3e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...