CVE-2024-3924

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-3924 Code Injection in huggingface/text-generation-inference

A code injection vulnerability exists in the huggingface/text-generation-inference repository, specifically within the autodocs.yml workflow file. The vulnerability arises from the insecure handling of the github.headref user input, which is used to dynamically construct a command for installing ...

CVE-2024-30172 vulnerabilities

Vulnerabilities for packages: elasticsearch, jruby, opensearch, ruby3.2-bouncy-castle-java, gradle, keycloak, gradle-stage0, ruby3.3-bouncy-castle-java, sonarqube-10...

GHSA-2G68-C3QC-8985 vulnerabilities

Vulnerabilities for packages: nemo, py3-werkzeug, kubeflow-volumes-web-app, superset, kubeflow-pipelines-visualization-server, airflow, airflow-core, kubeflow-jupyter-web-app...

MAL-2024-1308 Malicious code in not-exist-lykos-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4ae62646ef95a3157dcd61e8c0f58a25bec2c826d45f514c6e7bffde0126d4 The OpenSSF Package Analysis project identified 'not-exist-lykos-poc' @ 66.6.6 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-1274 Malicious code in ui-common-components-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0d823ab954cd19f85bb933d25f8230386023a6a1fd15430efce0298f6a25aa9 The OpenSSF Package Analysis project identified 'ui-common-components-angular' @ 1.3.1 npm as malicious. It is considered malicious because: - T...

GHSA-Q64H-39HV-4CF7 vulnerabilities

Vulnerabilities for packages: conftest-fips, kubescape, conftest, k9s, zarf, terraform, zot, tfsec, tflint...

GHSA-4VWX-54MW-VQFW vulnerabilities

Vulnerabilities for packages: traefik-fips, traefik...

CDeX 安全漏洞

CDeX is a free software package from CDeX Inc. for extracting digital audio from audio CDs and converting audio formats for Microsoft Windows. A security vulnerability exists in CDeX 5.7.1 and earlier versions that originated from allowing an attacker to conduct a brute force attack against a val...

IBM SPSS Statistics Resource Management Error Vulnerability

IBM SPSS Statistics is a software package from International Business Machines IBM. It is used for interactive or batch statistical analysis. A resource management error vulnerability exists in IBM SPSS Statistics, which can be exploited by an attacker to create multiple files, exhaust file handl...

EulerOS 2.0 SP8 : sos (EulerOS-SA-2024-1300)

According to the versions of the sos package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el86,...

CVE-2024-27308 vulnerabilities

Vulnerabilities for packages: linkerd-network-validator, cargo-audit, berg, topgrade, kdash, zellij, pulumi-watch, pgcat...

openSUSE: Security Advisory for trivy (openSUSE-SU-2022:10081-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MAL-2024-1036 Malicious code in djanggo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 011da0e2a451e787d1c7b54c29f3090de47bd2366de80983667665a70d885320 The OpenSSF Package Analysis project identified 'djanggo' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

SUSE-SU-2024:0442-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: - Set ExclusiveArch conditionally depending on th...

CVE-2023-51446 GLPI LDAP Injection during authentication

GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12...

GHSA-C24V-8RFC-W8VW vulnerabilities

Vulnerabilities for packages: vite...

Malicious code in discord.js-selfbot-dmallfriends-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1a0c3c66fdb2c5d4177a13be355a1578414167a74bf202f48f1380ba2a3379d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...