CVE-2021-31522

CVE-2021-31522 affects Apache Kylin: Kylin can receive user input and load arbitrary classes via Class.forName(...). Affected are Kylin 2.x (2.6.6 and earlier), 3.x (3.1.2 and earlier), and 4.x (4.0.0 and earlier). Root cause is unsafe dynamic class loading triggered by user input, exposing poten...

CVE-2021-31522 Apache Kylin unsafe class loading

Kylin can receive user input and load any class through Class.forName.... This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions...

Apache Kylin 输入验证错误漏洞

Apache Kylin is an open source distributed analytic data warehouse from the Apache Foundation. The product mainly provides SQL query interface on top of Hadoop/Spark and multi-dimensional analysis OLAP and other functions. Apache kylin has an input validation error vulnerability, which stems from...

Dashboard is not working , lend positiona are still loading, the same is for Lend button, Lend Amount to lend is not refresjing

Handle 0v3rf10w Vulnerability details Impact Detailed description of the impact of this finding. Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. Tools Used Recommended Mitigation Steps --- The...

PT-2022-4823

Name of the Vulnerable Software and Affected Versions Blender versions prior to 2.83.19 Blender versions prior to 2.93.8 Blender versions prior to 3.1 Description An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read...

The vulnerability of the Google Chrome browser’s background loading function allows a hacker to bypass content security policies and gain unauthorized access to protected information.

The vulnerability of the Google Chrome browser’s background loading function is related to privilege management errors. Exploiting this vulnerability could allow a remote attacker to bypass content security policies and gain unauthorized access to protected information...

The vulnerability of Google Chrome’s browser loading function allows a hacker to bypass existing security restrictions.

The vulnerability of Google Chrome’s browser loading function exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

The software for email security solutions from SonicWall, such as SonicWall Email Security and SonicWall Hosted Email Security, has vulnerabilities related to insufficient file checking during loading. This allows attackers to gain unauthorized access to protected information.

The vulnerability of SonicWall Email Security and SonicWall Hosted Email Security software lies in insufficient file checking during the loading process. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by downloading a malicious ZIP archive...

The vulnerability of the PHP framework Laravel, related to the unlimited loading of dangerous types of files, allows attackers to execute arbitrary code.

The vulnerability of the PHP framework Laravel is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Security update for python-Babel (important)

openSUSE Security Update: Security update for python-Babel Announcement ID: openSUSE-SU-2021:1553-1 Rating: important References: 1185768 Cross-References: CVE-2021-42771 CVSS scores: CVE-2021-42771 SUSE: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Affected Products: openSUSE Leap 15.2 An...

Code injection via unsafe YAML loading

Impact Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An attacker can add malicious code to the config file of a trained model and attempt to convince users to...

Remote Code Execution (RCE)

sockeye is vulnerable to remote code execution. The use of insecure loading of yaml for the model configuration files allows an attacker to execute arbitrary code embedded in config files...

Log4Shell HTTP Header Injection

Versions of Apache Log4j2 impacted by CVE-2021-44228 which allow JNDI features used in configuration, log messages, and parameters, do not protect against attacker controlled LDAP and other JNDI related endpoints. This module will exploit an HTTP end point with the Log4Shell vulnerability by...

CVE-2021-43811

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

PYSEC-2021-848

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

Code injection

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

CVE-2021-43811 Code injection via unsafe YAML loading

Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. Sockeye uses YAML to store model and data configurations on disk. Versions below 2.3.24 use unsafe YAML loading, which can be made to execute arbitrary code embedded in config files. An...

PT-2021-23951 · Sockeye · Sockeye

Name of the Vulnerable Software and Affected Versions: Sockeye versions prior to 2.3.24 Description: Sockeye is an open-source sequence-to-sequence framework for Neural Machine Translation built on PyTorch. It uses YAML to store model and data configurations on disk. The issue arises from unsafe...

CVE-2021-43176

The GOautodial API prior to commit 3c3a979 made on October 13th, 2021 takes a user-supplied “action” parameter and appends a .php file extension to locate and load the correct PHP file to implement the API call. Vulnerable versions of GOautodial do not sanitize the user input that specifies the...

PT-2021-5954 · Pdftron · Pdftron

Name of the Vulnerable Software and Affected Versions: PDFTron versions prior to 9.0.7 Description: A Memory Corruption issue may lead to code execution through maliciously crafted DLL files. The vulnerability is related to errors in the mechanism for checking the path to dynamically loaded...