7166 matches found
CVE-2024-27321
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python...
CVE-2024-27320
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...
CVE-2024-27320
The CVE-2024-27320 entry concerns the Refuel Autolabel library. The connected PT-2024-21820 and related sources confirm an arbitrary code execution flaw in versions 0.0.8 and newer, caused by handling of CSV files in classification tasks where Python code can be injected and executed via eval. Im...
CVE-2024-27320
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...
CVE-2024-27320
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...
CVE-2024-27320: Improper Neutralization of Directives in Dynamically Evaluated Code
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classification tasks handle provided CSV files. If a victim user creates a classification task using a maliciously crafted CSV file containing Python code, the code...
PT-2024-21820
Name of the Vulnerable Software and Affected Versions Refuel Autolabel library versions 0.0.8 and newer Description An arbitrary code execution issue exists due to the way the Refuel Autolabel library handles provided CSV files in its classification tasks. If a maliciously crafted CSV file...
Auto-label: Security Vulnerabilities
Autolabel is a Python library open-sourced by refuel-ai. It is used to label, clean, and enrich textual datasets using any Large Language Model LLM. A security vulnerability exists in Autolabel 0.0.8 and earlier versions, which stems from the presence of an arbitrary code execution vulnerability...
PT-2024-21821
Name of the Vulnerable Software and Affected Versions Refuel Autolabel library versions 0.0.8 and newer Description An arbitrary code execution issue exists due to the way multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a...
CVE-2024-27321: Improper Neutralization of Directives in Dynamically Evaluated Code
An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabel classification tasks handle provided CSV files. If a user creates a multilabel classification task using a maliciously crafted CSV file containing Python...
CVE-2024-27113
An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...
CVE-2024-27113 Insecure Direct Object Reference to export Database in SOPlanning before 1.52.02
An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...
CVE-2024-27113: Exposure of Sensitive Information to an Unauthorized Actor
An unauthenticated Insecure Direct Object Reference IDOR to the database has been found in the SO Planning tool that occurs when the public view setting is enabled. An attacker could use this vulnerability to gain access to the underlying database by exporting it as a CSV file. The vulnerability...
CVE-2024-42901
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...
CVE-2024-42901
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...
LimeSurvey security vulnerabilities
LimeSurvey PHPSurveyor is an open source online questionnaire program from the LimeSurvey team that supports survey program development, survey posting, and data collection. A security vulnerability exists in LimeSurvey version v6.5.12, which stems from the inclusion of a CSV injection...
CVE-2024-42901: Improper Neutralization of Input During Web Page Generation
A CSV injection vulnerability in Lime Survey v6.5.12 allows attackers to execute arbitrary code via uploading a crafted CSV file...
CVE-2024-42901
A CSV injection vulnerability exists in Lime Survey v6.5.12 , allowing attackers to execute arbitrary code by uploading a specially crafted CSV file. This vulnerability stems from the improper neutralization of input during the file upload process. Practical consequences include the potential exe...