4313 matches found
PYSEC-2024-60
A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...
CVE-2024-3651 Denial of Service via Quadratic Complexity in kjd/idna
A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...
CVE-2024-3651 Denial of Service via Quadratic Complexity in kjd/idna
A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...
Django: SQL injection in JSONField KeyTransform
A vulnerability was discovered in the JSONField KeyTransform functionality of Django. The vulnerability allowed SQL injection attacks by crafting malicious user input for the .values method. The vulnerability was demonstrated in the Django test suite, where a SQL syntax error was triggered by...
Linux kernel 安全漏洞
Linux kernel is a core component of an operating system that provides system calls, hardware driver management and other functions. As the cornerstone of modern computer operation, Linux kernel is not only stable and reliable, but also highly flexible and customizable. Linux kernel suffers from a...
SUSE CVE-2024-39236
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
DEBIAN-CVE-2024-4467
A flaw was found in the QEMU disk image utility qemu-img 'info' command. A specially crafted image file containing a json: value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write ...
Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
Withdrawn Advisory This advisory has been withdrawn because the it only affects a user who runs specifically crafted code that happens to use gradio library. More information can be found here. Original Description Gradio v4.36.1 was discovered to contain a code injection vulnerability via the...
GHSA-9V2F-6VCG-3HGV Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
Withdrawn Advisory This advisory has been withdrawn because the it only affects a user who runs specifically crafted code that happens to use gradio library. More information can be found here. Original Description Gradio v4.36.1 was discovered to contain a code injection vulnerability via the...
CVE-2024-39236
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
PYSEC-2024-274
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
PYSEC-2024-274
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
CVE-2024-20399 Cisco NX-OS Software CLI Command Injection Vulnerability
A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that ar...
CVE-2024-20399
Cisco NX-OS Software contains a CLI command injection vulnerability (CVE-2024-20399) that could allow an authenticated administrator to execute arbitrary root commands on the underlying OS. The issue arises from insufficient validation of parameters passed to specific configuration CLI commands, ...
CVE-2024-39236
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
CVE-2024-39236
Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/componentmeta.py. This vulnerability is triggered via a crafted input. NOTE: the supplier disputes this because the report is about a user attacking himself...
Gradio Security Vulnerability
Gradio is an open source Python library that is a way to demonstrate machine learning models through a friendly web interface. A security vulnerability exists in Gradio version 4.36.1, which stems from a code injection issue in a component, and may be triggered by carefully constructed input...
Heap-based Buffer Overflow
Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the zzipparserootdirectory function. An attacker can disrupt service and potentially execute arbitrary code by sending specially crafted inputs. Remediation A fix was pushed into the master branch but not...
USN-6845-1 libhibernate3-java vulnerability
It was discovered that Hibernate incorrectly handled certain inputs with unsanitized literals. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to obtain sensitive information...