14919 matches found
AlmaLinux 9 : nodejs:20 (ALSA-2024:5815)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5815 advisory. nodejs: Bypass network import restriction via data URL CVE-2024-22020 nodejs: fs.lstat bypasses permission model CVE-2024-22018 nodejs: fs.fchown/fchmod...
AlmaLinux 8 : nodejs:20 (ALSA-2024:5814)
The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:5814 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction via...
PT-2024-6443 · Unknown +1 · Invesalius +1
Name of the Vulnerable Software and Affected Versions: InVesalius versions 3.1.99991 through 3.1.99998 Description: The issue is related to an eval Injection vulnerability in the invesalius/reader/dicom.py component, which allows attackers to execute arbitrary code via loading a crafted DICOM fil...
LlamaIndex includes an exec call for `import {cls_name}`
An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...
GHSA-FXC2-8M62-M85X LlamaIndex includes an exec call for `import {cls_name}`
An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...
PYSEC-2024-192
An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...
CVE-2024-45201
An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...
GO-2022-0398 Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server
Import loops in account imports, nats-server DoS in github.com/nats-io/nats-server...
CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
CVE-2024-42362 GHSL-2023-255: HertzBeat Authenticated (user role) RCE via unsafe deserialization in /api/monitors/import
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
CVE-2024-42362
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
PT-2024-29897 · Hertzbeat · Hertzbeat
Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.6.0 Description: Hertzbeat is an open source, real-time monitoring system. It has an authenticated Remote Code Execution RCE vulnerability via unsafe deserialization in the "/api/monitors/import" API endpoint...
Hertzbeat security vulnerabilities
Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat prior to version 1.6.0 that stems from an insecure deserialization issue in the /api/monitors/import location that could lead to remote code execution...
CVE-2024-42362: Deserialization of Untrusted Data
Hertzbeat is an open source, real-time monitoring system. Hertzbeat has an authenticated user role RCE via unsafe deserialization in /api/monitors/import. This vulnerability is fixed in 1.6.0...
Authorization Bypass
io.github.microcks, microcks is vulnerable to Authorization Bypass. The vulnerability is caused due to a missing validation around POST /api/import and POST /api/export endpoints. This leads to Authorization bypass...
Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...
CVE-2024-44076
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...
CVE-2024-44076
In Microcks before 1.10.0, the POST /api/import and POST /api/export endpoints allow non-administrator access...
Microcks security vulnerabilities
Microcks is an open source Kubernetes tool for API mocking and testing. A security vulnerability exists in Microcks versions prior to 1.10.0 that stems from the POST /api/import and POST /api/export endpoints allowing non-administrative access...