CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response ti...

Timing Attack

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Timing Attack due to the analyticsdashboard function. An attacker can infer the correct hash byte-by-byte by measuring the response time of different...

GHSA-J757-PF57-F8R4 Gradio performs a non-constant-time comparison when comparing hashes

Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves a timing attack in the way Gradio compares hashes for the analyticsdashboard function. Since the comparison is not done in constant time, an attacker could exploit this by measuring the response time of differen...

WordPress Download Plugins and Themes in ZIP from Dashboard plugin <= 1.9.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Download Plugins and Themes from Dashboard versions = 1.9.1...

CVE-2024-8977 Server-Side Request Forgery (SSRF) in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks...

CVE-2024-8977 Server-Side Request Forgery (SSRF) in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks...

CVE-2024-8977

CVE-2024-8977 describes a Server‑Side Request Forgery (SSRF) in GitLab EE affecting versions from 15.10 up to 17.2.9, 17.3 up to 17.3.4, and 17.4 up to 17.4.2 when the Product Analytics Dashboard is configured and enabled. The vulnerability is exploitable over the network with no user interaction...

CVE-2024-8977

Removed by vendor...

WordPress Download Plugins and Themes from Dashboard Plugin <= 1.9.1 is vulnerable to Cross Site Scripting (XSS)

Software Download Plugins and Themes from Dashboard Type Plugin Vulnerable versions = 1.9.1 Fixed in 1.9.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9232 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 6207695f5b03...

PT-2024-6938 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 15.10 through 17.2.8 GitLab EE versions 17.3 through 17.3.4 GitLab EE versions 17.4 through 17.4.1 Description: An issue has been discovered in GitLab EE that could allow a remote attacker to perform a Server-Side Request...

CVE-2024-47822 Directus inserts access token from query string into logs

Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in req.query is not redacted when the LOGSTYLE is set to raw. If these logs are no...

October 8, 2024—KB5044343 (Monthly Rollup)

None None...

CVE-2024-47817

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

CVE-2024-47817

The CVE-2024-47817 entry describes an XSS vulnerability in Lara-zeus Dynamic Dashboard and Artemis due to unvalidated values passed to a paragraph widget. Affected versions include Dynamic Dashboard v3.0.0 through v3.0.2; Artemis theme/dash components are also implicated. Root cause: improper val...

CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus

Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a collection of themes for the lara-zeus ecosystem. If values passed to a paragraph widget are not valid and contain a specific set of characters, applications a...

GHSA-C6CW-G7FC-4GWC Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS

Summary If values passed to a paragraph widget are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a paragraph widget is rendered. Versions of dynamic dashboard from v3.0.0 through v3.0.2 are affected. Please...

Lara-zeus Dynamic Dashboard and Artemis do not validate paragraph widget values which can be used for XSS

Summary If values passed to a paragraph widget are not valid and contain a specific set of characters, applications are vulnerable to XSS attack against a user who opens a page on which a paragraph widget is rendered. Versions of dynamic dashboard from v3.0.0 through v3.0.2 are affected. Please...

Dynamic Dashboard 跨站脚本漏洞

Dynamic Dashboard is an open source dashboard by Lara Zeus. A cross-site scripting vulnerability exists in Dynamic Dashboard. An attacker could exploit this vulnerability to perform a cross-site scripting attack...

CVE-2024-9161

The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'updatemetadata' function in all versions up to, and including, 1.0.228. This makes it possible for unauthenticated...

CVE-2024-9161

The CVE-2024-9161 entry affects the WordPress plugin Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (versions up to 1.0.228). The root cause is a missing capability check in the function update_metadata , which allows unauthenticated users to insert, update, or delete metadata (including u...