MAL-2024-12303 Malicious code in maliciouspackage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d0e8a8d581266436f0546b5039ee82ab734d45f8489e281322dd871124dad9ce Clearly a demo malicious package, attempting to exfiltrate a token from the git config --- Category: PROBABLYPENTEST - Packages looking like typical pentest...

Malicious code in lwplugin (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c6d463791b2f4dc4cdb8a0b3961dbb9b956fc3f0e0ad974fc407211ae9d2e3a8 The attached DLL is infected with a very high detection rate --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in luna-paysure (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d22eccc425ab8fc5afe244efb33dd6d500ea6bcdf0942a02dedb3daa9f17da51 Importing the module causes exfiltrating of IP and hostname. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything...

MAL-2024-11698 Malicious code in robloxrequestsss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8fb526f76dced232dadcfbfa9e2ff4e48e14d9d9600f692c08323f7c44922784 During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in robloxrequestsss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8fb526f76dced232dadcfbfa9e2ff4e48e14d9d9600f692c08323f7c44922784 During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in discordmessager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 119a7015f090394365981291b03c6f5855b4dfd33da674c238c0c4323063a32a During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2024-11577 Malicious code in discordmessager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 119a7015f090394365981291b03c6f5855b4dfd33da674c238c0c4323063a32a During installation, a remote, highly obfuscated script is downloaded and executed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

CVE-2024-47870

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a race condition in the updaterootinconfig function, allowing an attacker to modify the root URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker ca...

CVE-2024-47867

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is...

CVE-2024-47867

CVE-2024-47867 describes lack of integrity verification for the FRP client downloaded by Gradio servers. If an attacker tampered with the remote URL, the binary could be replaced without detection, affecting users relying on Gradio server sharing that downloads the FRP client. The advisory ecosys...

CVE-2024-47867 Lack of integrity check on the downloaded FRP client in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is a lack of integrity check on the downloaded FRP client, which could potentially allow attackers to introduce malicious code. If an attacker gains access to the remote URL from which the FRP client is...

CVE-2024-47868 Several components’ post-process steps may allow arbitrary file leaks in Gradio

Gradio is an open-source Python package designed for quick prototyping. This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected...

CVE-2024-47164

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47871 Insecure communication between the FRP client and server in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves insecure communication between the FRP Fast Reverse Proxy client and server when Gradio's share=True option is used. HTTPS is not enforced on the connection, allowing attackers to intercept and rea...

CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47164 The `is_in_or_equal` function may be bypassed in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to the bypass of directory traversal checks within the isinorequal function. This function, intended to check if a file resides within a given directory, can be bypassed with certain payloads that...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47166 One-level read path traversal in `/custom_component` in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a one-level read path traversal in the /customcomponent endpoint. Attackers can exploit this flaw to access and leak source code from custom Gradio components by manipulating the file path in the...

CVE-2024-47168 The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...