CVE-2024-21576

CVE-2024-21576 affects ComfyUI-Bmad-Nodes, where a validation bypass in BuildColorRangeHSVAdvanced, FilterContour, and FindContour nodes allows an entrypoint to call eval, enabling an attacker to inject crafted workflow data and execute arbitrary code on the server. The issue is evidenced by mult...

CVE-2024-21576

ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...

CVE-2024-21576

ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...

PT-2024-18967

Name of the Vulnerable Software and Affected Versions ComfyUI-Bmad-Nodes affected versions not specified Description The issue is related to a code injection risk due to a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour, and FindContour custom nodes. This vulnerability can be...

ComfyUI Bmad Nodes 安全漏洞

ComfyUI Bmad Nodes is a utility node for ComfyUI by the bmad4ever individual developer. A security vulnerability exists in ComfyUI Bmad Nodes that stems from an authentication bypass in the BuildColorRangeHSVAdvanced, FilterContour, and FindContour custom nodes, which could lead to the execution ...

CVE-2024-21577: Improper Control of Generation of Code

ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACEExpressionEval node contains an eval in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server...

PT-2024-18968

Name of the Vulnerable Software and Affected Versions ComfyUI-Ace-Nodes affected versions not specified Description The issue concerns a Code Injection vulnerability. The ACE ExpressionEval node in ComfyUI-Ace-Nodes contains an eval function in its entrypoint that accepts arbitrary user-controlle...

CVE-2024-21576: Improper Control of Generation of Code

ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...

CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

Silicon Labs Z-Wave 700和Silicon Labs Z-Wave 800 安全漏洞

Silicon Labs Z-Wave 700 SiLabs Z-Wave 800 and Silicon Labs Z-Wave 800 SiLabs Z-Wave 800 are a series of chips from Silicon Labs, Inc. in the United States. A security vulnerability exists in Silicon Labs Z-Wave 700 and Silicon Labs Z-Wave 800 version v7.21.1, which stems from insecure privilege...

MAL-2024-11408 Malicious code in nodes-polyfill-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in nodes-polyfill-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-12247

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

CVE-2024-12247 Improper propagation of permission scheme updates across cluster nodes

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

CVE-2024-12247

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

CVE-2024-12247 Improper propagation of permission scheme updates across cluster nodes

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

CVE-2024-12247 Improper propagation of permission scheme updates across cluster nodes

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

CVE-2024-12247

Summary: CVE-2024-12247 affects Mattermost. Affected versions: 9.7.x up to 9.7.5, 9.8.x up to 9.8.2, and 9.9.x up to 9.9.2. Root cause: failure to propagate permission scheme updates across cluster nodes. Impact: a user can retain old permissions even after the permission scheme is updated. Evide...

CVE-2024-12247: Incorrect Authorization

Mattermost versions 9.7.x = 9.7.5, 9.8.x = 9.8.2 and 9.9.x = 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated...

Mattermost 安全漏洞

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost versions 9.7.x through 9.7.5, 9.8.x through 9.8.2, and 9.9.x through 9.9.2, which stems from an inability to properly propagate privilege scheme updates...