384 matches found
Medium: python3.9
Issue Overview: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "certstorestats" and "getcacerts". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContex...
Security Bulletin: Storage Virtualize Ansible Collection is affected by a vulnerability in the Python Cryptographic Authority package
Summary The Python cryptography package which provides both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, message digests, and key derivation functions, is used by IBM Ansible plug-in. This library is vulnerable to CVE-2024-26130...
PT-2024-23853
Name of the Vulnerable Software and Affected Versions parisneo/lollms version 5.9.0 Description A remote code execution issue exists in the create conda env function due to the use of shell=True in the subprocess.Popen function. This allows an attacker to inject arbitrary commands by manipulating...
LoLLMs Code Injection Vulnerability
LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A code injection vulnerability exists in LoLLMs version 5.9.0, which stems from the presence of a remote code execution vulnerability that allows an attacker to inject arbitrary commands via th...
Important: python3.11
Issue Overview: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can r...
PT-2024-7267 · Python +1 · Python +1
Name of the Vulnerable Software and Affected Versions: Python versions prior to 3.13 Description: The issue is related to the tempfile.mkdtemp function in Python, which on Windows, may not always set the correct permissions for the temporary directory, allowing other users to read and write to it...
Medium: python3.11
Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...
PT-2024-23559 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions where ROS VERSION is 2 and ROS PYTHON VERSION is 3 Description: A Denial-of-Service DoS issue exists, allowing a malicious user to remotely crash ROS2 nodes, causing a denial of service. The flaw leads to unexpected...
PT-2024-23581 · Unknown +1 · Ros Python Version +1
Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 versions 2 through 2, ROS PYTHON VERSION 3 Description: An arbitrary file upload issue has been discovered, allowing attackers to execute arbitrary code, cause a denial of service DoS, and obtain sensitive...
PT-2024-23568 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: An insecure deserialization issue allows attackers to execute arbitrary code via a crafted input to the Data Serialization and Deserialization Components,...
PT-2024-23564 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: An OS command injection issue has been discovered, allowing attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the comma...
PT-2024-23565 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions ROS VERSION 2 and ROS PYTHON VERSION 3 Description: A buffer overflow issue has been found in the C++ components, allowing attackers to execute arbitrary code or cause a Denial of Service DoS via improper handling of...
PT-2024-23570 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions where ROS VERSION is 2 and ROS PYTHON VERSION is 3 Description: An unauthorized node injection issue allows remote attackers to escalate privileges. Recommendations: For ROS2 Galactic Geochelone versions wher...
PT-2024-23549 · Unknown · Ros Melodic Morenia
Name of the Vulnerable Software and Affected Versions: ROS Melodic Morenia versions where ROS VERSION is 1 and ROS PYTHON VERSION is 3 Description: An unauthorized access issue has been discovered, potentially allowing a malicious user to gain unauthorized information access to multiple ROS nodes...
PT-2024-22898 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Humble Hawksbill versions where ROS VERSION is 2 and ROS PYTHON VERSION is 3 Description: An unauthorized access issue has been discovered, potentially allowing a malicious user to gain unauthorized access to multiple ROS2 nodes remotely...
PT-2024-14064 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 Foxy Fitzroy Description: An issue was discovered in shell command execution in ROS2, allowing an attacker to run arbitrary commands and cause other impacts. The issue is related to the ROS VERSION=2 and ROS PYTH...
PT-2024-14069 · Ros2 · Ros2
Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 versions Foxy Fitzroy Description: The issue is an OS command injection vulnerability in command processing or system call components. This allows attackers to run arbitrary commands. The ROS VERSION is 2 and ROS...
Security Bulletin: IBM Cinder plug-in is affected by a vulnerability in the Python requests-2.28.2-py3-none-any.whl [CVE-2023-32681]
Summary The Python requests package, which allows user to send HTTP requests using Python, is used by IBM Cinder plug-in. requests package is impacted by vulnerability CVE-2023-32681. Vulnerability Details CVEID:CVE-2023-32681 DESCRIPTION: python-requests could allow a remote attacker to obtain...
Mars: Information Exposure due to enabled debug mode
The server was found to be exposing system information to unauthenticated users due to the enabled debug mode. The disclosed information included details about the technologies and versions being used in the production system, such as the Python version, Django version, and the database driver in...
