CVE-2024-45187 Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution

Guest users in the Mage AI framework that remain logged in after their accounts are deleted, are mistakenly given high privileges and specifically given access to remotely execute arbitrary code through the Mage AI terminal server...

Authentication Bypass

mageai is vulnerable to Authentication Bypass. The vulnerability is due to insufficient authentication controls that allow remote unauthenticated access to the terminal server command history...

PT-2024-31469

Name of the Vulnerable Software and Affected Versions Mage AI framework affected versions not specified Description The issue concerns guest users in the Mage AI framework who remain logged in after their accounts are deleted. These users are mistakenly given high privileges, specifically access ...

GHSA-88G2-R9RW-G55H gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

RUSTSEC-2024-0364 gitoxide-core does not neutralize special characters for terminals

Summary The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometimes allows an untrusted repository to misrepresent its contents and to alter or concoct error messages...

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

GHSA-CGRQ-WVFJ-V28J Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

CVE-2024-8072

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

CVE-2024-8072

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

CVE-2024-8072 Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users

Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users...

PT-2024-30655 · Gitoxide · Gitoxide

Name of the Vulnerable Software and Affected Versions: gitoxide affected versions not specified Description: The gix and ein commands write pathnames and other metadata literally to terminals, even if they contain characters terminals treat specially, including ANSI escape sequences. This sometim...

JFrog 安全漏洞

JFrog is an application from JFrog, Inc. that provides an end-to-end pipeline to control the flow of binaries from build to production. A security vulnerability exists in JFrog. An attacker exploiting this vulnerability could disclose any user's terminal server command history...

PT-2024-38786

Name of the Vulnerable Software and Affected Versions: Mage AI affected versions not specified Description: The issue allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users. Recommendations: At the moment, there is no information about a newer versi...

GO-2023-2068 Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device in github.com/schollz/croc

Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device in github.com/schollz/croc...

GO-2023-2018 Argo CD web terminal session doesn't expire in github.com/argoproj/argo-cd

Argo CD web terminal session doesn't expire in github.com/argoproj/argo-cd...

GO-2023-1888 1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel

1Panel vulnerable to command injection when entering the container terminal in github.com/1Panel-dev/1Panel...

SUSE-SU-2024:2928-1 Security update for kubernetes1.25

This update for kubernetes1.25 fixes the following issues: - CVE-2021-25743: Fixed sanitization of raw data of escape, meta or control sequences before output it to terminal bsc1194400 Other fixes: - Included kubernetes1.25-client package. jscPED-5755...

kernel: vt: fix unicode buffer corruption when deleting characters

A vulnerability as found in the Linux kernel’s virtual terminal VT subsystem, which could lead to unicode buffer corruption when deleting characters. This issue arises from improper handling of unicode data, which can corrupt memory or lead to unintended behavior...