8428 matches found
GHSA-9FQ2-X9R6-WFMF Numpy Deserialization of Untrusted Data
DISPUTED An issue was discovered in NumPy 1.16.2 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior...
GHSA-HJR4-FHGP-23G9 qlib Deserialization of Untrusted Data vulnerability
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...
qlib Deserialization of Untrusted Data vulnerability
This affects all versions of package qlib. The workflow function in cli part of qlib was using an unsafe YAML load function...
Missing permission checks in Jenkins Chaos Monkey Plugin
Jenkins Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints. This allows attackers with Overall/Read permission to generate load and to generate memory leaks. Jenkins Chaos Monkey Plugin 0.4 requires Overall/Administer permission to generate load and t...
Mattermost Server: initial_load API exposes unnecessary information
An issue was discovered in Mattermost Server before 3.1.1. The initialload API disclosed unnecessary personal information...
GHSA-R93J-3MMP-PX57 Mattermost Server: initial_load API exposes unnecessary information
An issue was discovered in Mattermost Server before 3.1.1. The initialload API disclosed unnecessary personal information...
GHSA-JJW5-XXJ6-PCV5 scikit-learn Deserialization of Untrusted Data
scikit-learn aka sklearn through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load function, if reduce makes an os.system call. NOTE: third parties dispute this issue because the joblib.load function is documented as unsafe and it is the user's...
GHSA-4QHR-Q7WF-94XP Deserialization of Untrusted Data in JYaml
JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load function. NOTE: this is a discontinued product...
MySQL for Node.js Unsafe Options
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
GHSA-F982-MXWC-3MRX MySQL for Node.js Unsafe Options
An issue was discovered in the mysql aka mysqljs module 2.17.1 for Node.js. The LOAD DATA LOCAL INFILE option is open by default...
Solana Rbpf 输入验证错误漏洞
Solana Rbpf is a Rust Virtual Machine and Jit compiler for Ebpf programs from the Solana Foundation in Switzerland. A security vulnerability exists in Solana Rbpf versions prior to 0.2.29, which stems from an integer overflow problem. An attacker can exploit this vulnerability to cause a program ...
CVE-2022-23632
Traefik is an HTTP reverse proxy and load balancer. Prior to version 2.6.1, Traefik skips the router transport layer security TLS configuration when the host header is a fully qualified domain name FQDN. For a request, the TLS configuration choice can be different than the router choice, which...
CVE-2022-29199
TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of tf.rawops.LoadAndRemapMatrix does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack. Th...
new packages: perl-Module-Load-Conditional
An update is available for perl-Module-Load-Conditional. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see...
new packages: perl-Module-Load
An update is available for perl-Module-Load. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...
GHSA-FCGM-62P3-F7CM phpMyAdmin Local file exposure
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...
phpMyAdmin Local file exposure
An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL INFILE functionality to expose files on the server to the database system. All 4.6.x versions prior to 4.6.4, 4.4.x versions prior to 4.4.15.8, and 4.0.x versions prior to 4.0.10.17 are affected...
PT-2022-20399 · Jenkins · Jenkins Pipeline: Groovy Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 2689.v434009a 31b f1 and earlier Description: The issue allows loading any Groovy source files on the classpath of Jenkins and Jenkins plugins in sandboxed pipelines. This could potentially be used to...
Jenkins Pipeline Groovy Plugin 安全漏洞
Jenkins Pipeline is a set of plugins that support the implementation and integration of continuous delivery pipelines into Jenkins.Jenkins Pipeline: Groovy Plugin is vulnerable to a security feature issue that could be exploited by an attacker to load any Groovy source file on the class path of...
Improper Input Validation
The setmgmtparameters function in item.py in cobbler before 2.2.2 allows context-dependent attackers to execute arbitrary code via vectors related to the use of the yaml.load function instead of the yaml.safeload function, as demonstrated using Puppet...