CVE-2024-6961 XXE in Guardrails AI when consuming RAIL documents

RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity...

CVE-2024-6961

CVE-2024-6961 describes an XML External Entity (XXE) vulnerability in Guardrails AI when consuming RAIL documents from external sources, potentially allowing leakage of internal file data via the SYSTEM entity. The affected component is Guardrails AI and its RAIL document handling; the underlying...

CVE-2024-6961 XXE in Guardrails AI when consuming RAIL documents

RAIL documents are an XML-based format invented by Guardrails AI to enforce formatting checks on LLM outputs. Guardrails users that consume RAIL documents from external sources are vulnerable to XXE, which may cause leakage of internal file data via the SYSTEM entity...

Fedora 40 : fluent-bit (2024-07db6333b0)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-07db6333b0 advisory. Update to 3.0.4 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora 40 : botan2 (2024-7f42bafbdb)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-7f42bafbdb advisory. Rebase to v2.19.5 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

AlmaLinux 9 : qt5-qtbase (ALSA-2024:4623)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4623 advisory. qtbase: qtbase: Delay any communication until encrypted can be responded to CVE-2024-39936 Tenable has extracted the preceding description block directly from the...

Ivanti Endpoint Manager - July 2024 Security Update

The version of Ivanti Endpoint Manager running on the remote host lacking the July 2024 Hotfix. It is, therefore, affected by an unspecified SQL Injection vulnerability in the Core server of Ivanti EPM 2024 flat that allows an authenticated attacker within the same network to execute arbitrary...

Oracle Linux 9 : qt5-qtbase (ELSA-2024-4623)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4623 advisory. 5.15.9-10 - HTTP2: Delay any communication until encrypted can be responded to Resolves: RHEL-46348 Tenable has extracted the preceding description block direct...

Slackware Linux 15.0 / current httpd Multiple Vulnerabilities (SSA:2024-200-01)

The version of httpd installed on the remote host is prior to 2.4.62. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-200-01 advisory. New httpd packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the preceding...

Fedora 39 : golang (2024-5b06c85574)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5b06c85574 advisory. This update fixes CVE-2024-24791 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Slackware Linux 15.0 / current openssl Multiple Vulnerabilities (SSA:2024-199-01)

The version of openssl installed on the remote host is prior to 1.1.1za. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-199-01 advisory. New openssl packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

Fedora 39 : yt-dlp (2024-72fb215fcd)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-72fb215fcd advisory. Update to 2024.07.09 ---- Update to 2024.07.07 ---- Update to 2024.07.02 Tenable has extracted the preceding description block directly from the Fedora...

Fedora 39 : erlang-jose (2024-9484b6915b)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-9484b6915b advisory. Re-reviewed Jose ver. 1.11.10 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not test...

Rocky Linux 8 : python-jinja2 (RLSA-2024:4231)

The remote Rocky Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2024:4231 advisory. jinja2: accepts keys containing non-attribute characters CVE-2024-34064 Tenable has extracted the preceding description block directly from the Rocky Linux...

Rocky Linux 9 : openssh (RLSA-2024:4457)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4457 advisory. openssh: Possible remote code execution due to a race condition in signal handling affecting Rocky Linux 9 CVE-2024-6409 Tenable has extracted the preceding...

Rocky Linux 8 : python-pillow (RLSA-2024:4227)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4227 advisory. python-pillow: buffer overflow in imagingcms.c CVE-2024-28219 Tenable has extracted the preceding description block directly from the Rocky Linux security...

Fedora 40 : yarnpkg (2024-eef12396fc)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-eef12396fc advisory. Backport fix for CVE-2024-4067. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Fedora 39 : python3.6 (2024-7bba7e65d3)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-7bba7e65d3 advisory. Security fix for CVE-2024-4032 rhbz2293394 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus...

SAP NetWeaver AS ABAP Information Disclosure (3454858)

Under certain conditions SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to access remote-enabled function module with no further authorization which would otherwise be restricted, the function can be used to read non-sensitive information with low impact on...

SUSE SLES15 Security Update : skopeo (SUSE-SU-2024:2383-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2383-1 advisory. - CVE-2024-3727: Added missing image digest verification bsc1224123. Tenable has extracted the preceding description block directly from the...