PT-2025-1598 · Google · Gvisor

Name of the Vulnerable Software and Affected Versions: gVisor affected versions not specified Description: The issue concerns weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor. This allowed an external attacker to predict these values in certain...

Google gVisor 安全漏洞

Google gVisor is a user-space kernel written in the Go language for use in Linux systems. A security vulnerability exists in Google gVisor that stems from a weak mechanism for generating TCP/UDP source port equivalents, which makes it susceptible to the Port and Header Value Predictability...

SonicWALL SonicOS 安全漏洞

SonicWALL SonicOS is an operating system designed for SonicWall firewall appliances from SonicWALL Inc. in the United States. A security vulnerability exists in SonicWALL SonicOS that stems from the use of a cryptographically weak pseudo-random number generator PRNG in the authentication token...

CVE-2025-0218 pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service

When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficiently seeded random number generator is used when generating the directory name, leading to the possibility for a local attacker to pre-creat...

Session Fixation

github.com/drakkan/sftpgo is vulnerable to a session Cookie Prediction vulnerability. The vulnerability is due to the predictable generation of session cookies using the xid library, which results in cookies that are unique but not cryptographically secure, allows an attacker to brute force sessi...

CVE-2024-53702

CVE-2024-53702 describes a cryptographically weak PRNG issue in the SonicWall SMA100 SSLVPN backup code generator, allowing an attacker to potentially predict the generated secret. Affected product: SonicWall SMA100 SSLVPN (backup code generator). Root cause: use of a weak PRNG. Impact: potential...

Flowise OverrideConfig security vulnerability

Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition when the fallback socketpair implementation is used on platforms that lack native support and the vulnerable function does not properly authenticate the connected sockets. An attacker must be able to predict the address a...

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

Impact What kind of vulnerability is it? Who is impacted? This vulnerability is a data validation issue in the Gradio Dropdown component's pre-processing step. Even if the allowcustomvalue parameter is set to False, attackers can bypass this restriction by sending custom requests with arbitrary...

CentOS 7 : kernel-alt (RHSA-2020:0174)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory. - In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket...

GHSA-Q9R8-89XR-4XV4 MindsDB Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

MindsDB Deserialization of Untrusted Data vulnerability

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

CVE-2024-45853

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

PYSEC-2024-83

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

CVE-2024-45853

Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhouse’ model to run arbitrary code on the server when used for a prediction...

PT-2024-31810 · Mindsdb · Mindsdb

Name of the Vulnerable Software and Affected Versions: MindsDB versions 23.10.2.0 and newer Description: The issue concerns the deserialization of untrusted data in the MindsDB platform. This allows a maliciously uploaded 'inhouse' model to run arbitrary code on the server when used for a...

MindsDB 安全漏洞

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. A security vulnerability exists in MindsDB version 23.10.2.0 and earlier, which stems from the presence of deserialization of untrusted data, allowing maliciously uploaded models to run arbitrary code on the server when...

Unspecified Vulnerability in Rockwell Automation Pavilion8

Rockwell Automation Pavilion8 is a model prediction console from Rockwell Automation. A security vulnerability in Rockwell Automation Pavilion8 version 5.20, which stems from a lack of encryption of sensitive information, can be exploited by an attacker to cause data sent between the console and...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect prediction that leads to array indexing problems...

CVE-2024-42165 Arbitrary User Activation

Insufficiently random values for generating activation token in FIWARE Keyrock = 8.4 allow attackers to activate accounts of any user by predicting the token for the activation link...