EUVD-2020-19676

Malware in sbrugna...

EUVD-2024-47492

Malicious code in bioql PyPI...

EUVD-2023-35080

Malicious code in bioql PyPI...

EUVD-2023-39979

Malicious code in bioql PyPI...

EUVD-2022-3197

Malicious code in bioql PyPI...

EUVD-2023-1344

Malicious code in bioql PyPI...

EUVD-2023-1225

Malicious code in bioql PyPI...

EUVD-2024-47729

Malicious code in bioql PyPI...

EUVD-2022-7433

Malicious code in bioql PyPI...

EUVD-2022-3741

Malicious code in bioql PyPI...

EUVD-2022-6917

Malicious code in bioql PyPI...

EUVD-2023-2852

Malicious code in bioql PyPI...

EUVD-2023-1371

Malicious code in bioql PyPI...

External Data Extraction Attacks against Retrieval-Augmented Large Language Models

In recent years, RAG has emerged as a key paradigm for enhancing large language models LLMs. By integrating externally retrieved information, RAG alleviates issues like outdated knowledge and, crucially, insufficient domain expertise. While effective, RAG introduces new risks of external data...

mod_http2 -- Multiple vulnerabilities

The modhttp2 project reports: a client can increase memory consumption for a HTTP/2 connection via repeated request header names,leading to denial of service certain proxy configurations whith modproxyhttp2 as the backend, an assertion can be triggered by certain requests, leading to denial of...

CVE-2024-28159

A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission to trigger a build...

CVE-2024-5687

If a specific sequence of actions is performed when opening a new tab, the triggering principal associated with the new tab may have been incorrect. The triggering principal is used to calculate many values, including the Referer and Sec- headers, meaning there is the potential for incorrect...

CVE-2022-41238

A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits...

CVE-2019-13930

A vulnerability has been identified in XHQ All versions V6.0.0.2. The web interface could allow a Cross-Site Request Forgery CSRF attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be...

CVE-2019-12215

A full path disclosure vulnerability was discovered in Matomo v3.9.1 where a user can trigger a particular error to discover the full path of Matomo on the disk, because lastError.file is used in plugins/CorePluginsAdmin/templates/safemode.twig. NOTE: the vendor disputes the significance of this...