python-pillow: uncontrolled resource consumption when textlength in an ImageDraw instance operates on a long text argument

A flaw was found in Pillow. A denial of service issue uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for TrueType in ImageFont when text length in an ImageDraw instance operates on a long text argument...

SQL Injection

llamaindex is vulnerable to SQL Injection. The vulnerable due to improper prompt sanitization wihtin the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. This flaw allows an attacker inject arbitrary SQL...

Meross MSH30Q Security Vulnerability

The Meross MSH30Q is a smart Wi-Fi hub from Meross. A security vulnerability exists in the Meross MSH30Q version 4.5.23, which stems from susceptibility to the transmission of sensitive information in clear text...

The vulnerability of the IOTextEncryptionFamily component in iOS, macOS, and iPadOS allows a hacker to execute arbitrary code.

The vulnerability of the IOTextEncryptionFamily component in iOS, macOS, and iPadOS is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

GHSA-2JXW-4HM4-6W87 SQL injection in llama-index

LlamaIndex aka llamaindex through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

CVE-2024-23751

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

PYSEC-2024-12

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

PYSEC-2024-12

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

CVE-2024-23751

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

CVE-2024-23751

LlamaIndex aka llamaindex through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro...

PT-2024-20057

Name of the Vulnerable Software and Affected Versions LlamaIndex aka llama index versions 0.9.34 and earlier Description The issue allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and...

Apache Commons Text 1.9 Remote Code Execution Exploit

This Metasploit module exploit takes advantage of the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to remote code execution. This is due to a logic flaw that makes the script, dns and url lookup...

POPS Rebel Bluetooth Glucose Monitoring System Security Vulnerability

POPS Rebel Bluetooth Glucose Monitoring System is a blood glucose monitoring system from POPS Rebel. A security vulnerability exists in the POPS Rebel Bluetooth Glucose Monitoring System version 5.0, which originates from the application's presence in the clear text transmission of sensitive...

Apache Commons Text 1.9 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Commons Text RCE', 'Description' = %q This exploit takes advantage of the StringSubstitutor interpolator class, which is included in the...

CVE-2023-43824

A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code...

CVE-2023-43815

A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wScreenDESCTextLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution...

[SECURITY] Fedora 39 Update: golang-x-text-0.14.0-1.fc39

Text is a repository of text-related packages related to internationalization i18n and localization l10n, such as character encodings, text transformations, and locale-specific text handling...

[SECURITY] Fedora 38 Update: golang-x-text-0.14.0-1.fc38

Text is a repository of text-related packages related to internationalization i18n and localization l10n, such as character encodings, text transformations, and locale-specific text handling...

Fedora 39 : golang-x-text (2024-b85b97c0e9)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b85b97c0e9 advisory. update to v0.14.0, address CVE-2023-39325 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note tha...

Oracle Database Server (January 2024 CPU)

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2024 CPU advisory. - Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.21 and 21.3-21.12. Easi...