2802 matches found
SUSE CVE-2024-9779
A flaw was found in Open Cluster Management OCM when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named...
Monero: Remote memory exhaustion in Epee RPC stack under zero Receive Window
The Epee RPC stack in Monero was vulnerable to memory exhaustion attacks. Delayed ACK or zero Receive Window advertisements could cause the server to keep responses in the send queue until memory was exhausted. This could lead to remote crashes of Monero nodes that exposed their RPC interfaces...
SUSE CVE-2023-3676
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
SUSE CVE-2023-3955
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes...
CVE-2024-21577
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACEExpressionEval node contains an eval in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server...
CVE-2024-21576
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...
CVE-2024-21577
The CVE-2024-21577 entry concerns ComfyUI-Ace-Nodes, where the ACE_ExpressionEval node exposes an eval() in its entrypoint, allowing an attacker-controlled input to execute arbitrary code on the server. The vulnerability arises from evaluating user-supplied data, enabling potential code injection...
CVE-2024-21577
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACEExpressionEval node contains an eval in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server...
CVE-2024-21576
CVE-2024-21576 affects ComfyUI-Bmad-Nodes, where a validation bypass in BuildColorRangeHSVAdvanced, FilterContour, and FindContour nodes allows an entrypoint to call eval, enabling an attacker to inject crafted workflow data and execute arbitrary code on the server. The issue is evidenced by mult...
CVE-2024-21576
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...
CVE-2024-21576
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...
PT-2024-18967
Name of the Vulnerable Software and Affected Versions ComfyUI-Bmad-Nodes affected versions not specified Description The issue is related to a code injection risk due to a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour, and FindContour custom nodes. This vulnerability can be...
ComfyUI Bmad Nodes 安全漏洞
ComfyUI Bmad Nodes is a utility node for ComfyUI by the bmad4ever individual developer. A security vulnerability exists in ComfyUI Bmad Nodes that stems from an authentication bypass in the BuildColorRangeHSVAdvanced, FilterContour, and FindContour custom nodes, which could lead to the execution ...
CVE-2024-21577: Improper Control of Generation of Code
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACEExpressionEval node contains an eval in its entrypoint function that accepts arbitrary user-controlled data. A user can create a workflow that results in executing arbitrary code on the server...
CVE-2024-21576: Improper Control of Generation of Code
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour custom nodes. In the entrypoint function to each node, there’s a call to eval which can be triggered by generating a workflow that injects ...
PT-2024-18968
Name of the Vulnerable Software and Affected Versions ComfyUI-Ace-Nodes affected versions not specified Description The issue concerns a Code Injection vulnerability. The ACE ExpressionEval node in ComfyUI-Ace-Nodes contains an eval function in its entrypoint that accepts arbitrary user-controlle...
CVE-2024-21574
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...
Silicon Labs Z-Wave 700和Silicon Labs Z-Wave 800 安全漏洞
Silicon Labs Z-Wave 700 SiLabs Z-Wave 800 and Silicon Labs Z-Wave 800 SiLabs Z-Wave 800 are a series of chips from Silicon Labs, Inc. in the United States. A security vulnerability exists in Silicon Labs Z-Wave 700 and Silicon Labs Z-Wave 800 version v7.21.1, which stems from insecure privilege...
