PYSEC-2024-194

A clickjacking vulnerability exists in zenml-io/zenml versions up to and including 0.55.5 due to the application's failure to set appropriate X-Frame-Options or Content-Security-Policy HTTP headers. This vulnerability allows an attacker to embed the application UI within an iframe on a malicious...

CVE-2024-2928 Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

A Local File Inclusion LFI vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can...

evmos allows transferring unvested tokens after delegations

Impact This advisory has been created to address the following vulnerabilities found in the Evmos codebase and affecting vesting accounts. Wrong spendable balance computation The spendable balance is not updated properly when delegating vested tokens. The following example help in describing the...

CVE-2024-1879 CSRF to RCE in significant-gravitas/autogpt

A Cross-Site Request Forgery CSRF vulnerability in significant-gravitas/autogpt version v0.5.0 allows attackers to execute arbitrary commands on the AutoGPT server. The vulnerability stems from the lack of protections on the API endpoint receiving instructions, enabling an attacker to direct a us...

CGA-QX87-H6F7-QRHX

Bulletin has no description...

CGA-QPC6-Q3RR-9W6F

Bulletin has no description...

CGA-PR9G-VP66-5C42

Bulletin has no description...

CGA-H678-4W9J-J6WR

Bulletin has no description...

CGA-G23G-X4FP-QHM6

Bulletin has no description...

CGA-F8W5-R65V-F34H

Bulletin has no description...

CGA-CQ7Q-JXPV-6FGM

Bulletin has no description...

CGA-V3F8-QH5V-287C

Bulletin has no description...

CGA-R694-QWCG-7XVX

Bulletin has no description...

CGA-PX7H-7XF8-Q54X

Bulletin has no description...

CGA-HXJ2-9WW8-PCP7

Bulletin has no description...

CGA-GCX2-V78G-8R3P

Bulletin has no description...

CGA-V64C-HF56-674V

Bulletin has no description...

CGA-5RCG-3VRP-XHG6

Bulletin has no description...

CGA-6MP3-8635-PXMR

Bulletin has no description...

PT-2024-32374 · WordPress · Testimonials Widget

Name of the Vulnerable Software and Affected Versions: Testimonials Widget plugin for WordPress versions up to, and including, 4.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's testimonials shortcode due to insufficient input sanitization and output escaping ...