Exploit for Missing Authorization in Sonaar Mp3_Audio_Player_For_Music\,_Radio_\&_Podcast

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2024-45034 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2024-45034 Source advisory:...

PYSEC-2024-266

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2024-45034 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2024-45034 Source advisory:...

CVE-2024-45498 Apache Airflow: Command Injection in an example DAG

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

CVE-2024-45498 Apache Airflow: Command Injection in an example DAG

Example DAG: exampleinleteventextra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the...

CVE-2024-45498

Apache Airflow version 2.10.0 is vulnerable to command injection via the example DAG example_inlet_event_extra.py. An authenticated attacker with only DAG trigger permissions can exploit this flaw to execute arbitrary commands due to improper encoding or escaping of output. It is recommended to a...

Apache Airflow security vulnerabilities

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache USA Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow version 2.10.0, which stems from mishandling in the...

PT-2024-31664 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow version 2.10.0 Description: The issue allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. This is related to the example DAG example inlet event extra.py shipped with Apache Airflow...

Malicious code in dependency-confusion-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 229d38e7d2d3105bfcd37f65885ebaebcf9746721aba7bdec84e88810b454ee0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dependency-confusion-example

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in example-pypi-package-loler1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb19218b6d780973bde55d613a16a9a637728a4d01e79d570bb3406633f0f639 Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

com.pep1:pep1-commons-rest (0.6), io.syndesis:http-pull-push-example (>=0.4.2, <=0.4.5) +5 more potentially affected by CVE-2024-7885 via io.undertow:undertow-core (1.3.27.final)

io.undertow:undertow-core MAVEN version 1.3.27.final is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - com.pep1:pep1-commons-rest 0.6 - io.syndesis:http-pull-push-example =0.4.2, =0.4.2, =0.4.2, =0.4.5 -...

Spring AI with NVIDIA LLM API

Spring AI now supports NVIDIA's Large Language Model API, offering integration with a wide range of models. By leveraging NVIDIA's OpenAI-compatible API, Spring AI allows developers to use NVIDIA's LLMs through the familiar Spring AI API. We'll explore how to configure and use the Spring AI OpenA...

Spring AI with Groq - a blazingly fast AI inference engine

Faster information processing not only informs - it transforms how we perceive and innovate. Spring AI, a powerful framework for integrating AI capabilities into Spring applications, now offers support for Groq - a blazingly fast AI inference engine with support for Tool/Function calling...

com.introproventures:graphql-jpa-query-boot-starter (>=0.3.8, <=0.3.9), com.introproventures:graphql-jpa-query-example (>=0.3.8, <=0.3.9) +1 more potentially affected by CVE-2024-40094 via com.graphql-java:graphql-java (9.4)

com.graphql-java:graphql-java MAVEN version 9.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.graphql-java:graphql-java and may be impacted: - com.introproventures:graphql-jpa-query-boot-starter =0.3.8, =0.3.8, =0.3.8, =0.3.9 Source cves:...

MAL-2025-1973 Malicious code in example-vizsla-tutorial (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5047acdff9541b0968719265aafdedb63d94f9adb9889f60c8705ada8c58966 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in example-vizsla-tutorial (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d5047acdff9541b0968719265aafdedb63d94f9adb9889f60c8705ada8c58966 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Spring AI with Ollama Tool Support

Earlier this week, Ollama introduced an exciting new feature: tool support for Large Language Models LLMs. Today, we're thrilled to announce that Spring AI 1.0.0-SNAPSHOT has fully embraced this powerful feature, bringing Ollama's function calling capabilities to the Spring ecosystem. Ollama's to...

cobras (>=2.1.8, <=2.2.4), example-pkg-in8utils (0.0.1) +3 more potentially affected by CVE-2024-40647 via sentry-sdk (0.12.3)

sentry-sdk PYPI version 0.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on sentry-sdk and may be impacted: - cobras =2.1.8, =1.0.0, =1.0.43 Source cves: CVE-2024-40647 Source advisory: OSV:GHSA-G92J-QHMH-64V2...