CGA-459F-7Q78-RXC5

Bulletin has no description...

CGA-3433-JRRM-RH79

Bulletin has no description...

CGA-345F-W8WP-56GH

Bulletin has no description...

CGA-22C8-MRMM-4HQ4

Bulletin has no description...

CGA-229C-42R9-3975

Bulletin has no description...

CGA-45G9-VHCP-R7RP

Bulletin has no description...

CGA-MJH7-V2GP-8MH2

Bulletin has no description...

CGA-CQ2C-5P2G-2JVC

Bulletin has no description...

CGA-8HX4-975M-9JM7

Bulletin has no description...

CGA-3Q2P-5755-65HQ

Bulletin has no description...

CGA-42PP-GWP5-Q5P4

Bulletin has no description...

PT-2024-27141 · Oneflow · Oneflow

Name of the Vulnerable Software and Affected Versions: Oneflow version 0.9.1 Description: The issue allows attackers to cause a Denial of Service DoS when an empty array is processed with oneflow.tensordot. Recommendations: For version 0.9.1, consider avoiding the use of oneflow.tensordot with...

PT-2024-30411

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version 4.21.0 Description A Server-Side Request Forgery SSRF vulnerability exists, specifically within the "/queue/join" endpoint and the save url to cache function. The vulnerability arises when the path value, obtained fro...

Time-Based Information Disclosure Vulnerability in Flow

The PersistedUsernamePasswordProvider was prone to a information disclosure of account existance based on timing attacks as the hashing of passwords was only done in case an account was found. We changed the core so that the provider always does a password comparison in case credentials were...

GO-2024-2871 Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder

Stacklok Minder vulnerable to denial of service from maliciously crafted templates in github.com/stacklok/minder...

CVE-2024-5526

Grafana OnCall is an easy-to-use on-call management tool that will help reduce toil in on-call management through simpler workflows and interfaces that are tailored specifically for engineers. Grafana OnCall, from version 1.1.37 before 1.5.2 are vulnerable to a Server Side Request Forgery SSRF...

Cross-site Scripting (XSS)

activeadmin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input in dynamic legends, which allows for the injection of arbitrary JavaScript code when creating entities with names that include a script payload...

Remote code execution in web server context

User with administrative privileges and upload files that look like images but contain PHP code which can then be executed in the context of the web server...

GHSA-5JQC-QJ57-4HRC Jan path traversal vulnerability

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface...

GHSA-QFJH-MVQ6-C5P8 Jan path traversal vulnerability

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. @janhq/core has been deprecated in favor of janhq/jan, this vulnerability has been patched there in v0.5.2...