CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

Design/Logic Flaw

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

CVE-2023-6019

A command injection existed in Ray's cpuprofile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here:...

CVE-2023-6038

CVE-2023-6038 describes a Local File Inclusion in the h2o-3 REST API (ImportFiles and ParseSetup endpoints). An unauthenticated attacker can read arbitrary files on the server with the h2o-3 process’s user permissions. Affected version identified in sources is 3.40.0.4. The issue is severity high...

CVE-2023-6016

CVE-2023-6016 affects H2O Dashboard via POJO model import, enabling remote code execution on a server hosting the dashboard. The vulnerability is described as a high-severity, network-exploitable issue with no user interaction required, per the NVD metrics (CVSSv3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I...

CVE-2023-6016

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

CVE-2023-6016 H2O Remote Code Execution via POJO Model Import

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

H2O Security Breach

H2O is an in-memory platform for distributed, scalable machine learning. H2O suffers from a security vulnerability that stems from allowing an unauthenticated attacker to read any file on the server where the H2O dashboard resides...

CVE-2023-6016: Improper Control of Generation of Code

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature...

Ray Operating System Command Injection Vulnerability

Ray is a unified framework for scaling AI and Python applications open-sourced by ray-project. Ray suffers from an OS command injection vulnerability that stems from a command injection vulnerability in the cpuprofile URL parameter. An attacker can exploit this vulnerability to run the Ray...

Security Bulletin: Operations Dashboard is vulnerable to remote code execution due to Go

Summary Operations Dashboard is vulnerable to remote code execution due to Go CVE-2023-39320 with details below. The vulnerability has been addressed. Vulnerability Details CVEID: CVE-2023-39320 DESCRIPTION: Golang Go could allow a remote attacker to execute arbitrary code on the system, caused b...

Moderate: Red Hat Security Advisory: grafana security and enhancement update

An update for grafana is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

VulnCheck KEV: CVE-2021-3223

Node-RED-Dashboard before 2.26.2 allows uibase/js/..%2f directory traversal to read files...

ALSA-2023:6972 Moderate: grafana security and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Moderate: grafana security and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: grafana: account takeover possible when using Azure AD OAuth CVE-2023-3128 For more details about the security issues, including the impact, a CVSS score, acknowledgments,...

Malware in flink-dashboard

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

WordPress Ultimate Dashboard Plugin <= 3.7.7 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate Dashboard Type Plugin Vulnerable versions = 3.7.7 Fixed in 3.7.8 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4726 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID f3f77cbb9f76 Credits Marco Wotschka Requir...

Malicious code in flink-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9f73b295599c7e74ec00ae60260502674bcb6b7077f1845295691fee703495 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8502 Malicious code in flink-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9f73b295599c7e74ec00ae60260502674bcb6b7077f1845295691fee703495 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Veeam ONE 11.x < 11.0.0.1379 / 11.0.1.x < 11.0.1.1880 / 12.x < 12.0.1.2591 Multiple Vulnerabiltiies (KB4508)

The version of Veeam ONE installed on the remote Windows host is affected by multiple vulnerabilities, as disclosed in the vendor's advisory with KB ID 4508, including the following: - A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection...