PYSEC-2024-214

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

PYSEC-2024-196

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47165

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47084

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

CVE-2024-47165

CVE-2024-47165 affects Gradio (Python). When running Gradio locally, the localhost_aliases list incorrectly includes "null" as a valid origin, enabling requests from sandboxed iframes or sources with a null origin. This can lead to data theft such as authentication tokens or uploaded files for us...

CVE-2024-47165 CORS origin validation accepts the null origin in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthoriz...

Gradio's CORS origin validation accepts the null origin

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthorized requests fr...

GHSA-89V2-PQFV-C5R9 Gradio's CORS origin validation accepts the null origin

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhostaliases variable includes "null" as a valid origin. This allows attackers to make unauthorized requests fr...

Gradios's CORS origin validation is not performed when the request has a cookie

Impact What kind of vulnerability is it? Who is impacted? This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server...

GHSA-3C67-5HWX-F6WX Gradios's CORS origin validation is not performed when the request has a cookie

Impact What kind of vulnerability is it? Who is impacted? This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio server...

PT-2024-32398

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 4.44 Description This issue is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests t...

PT-2024-32448 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 5.0 Description: This issue relates to CORS origin validation accepting a null origin. When a Gradio server is deployed locally, the localhost aliases variable includes "null" as a valid origin, allowing attackers to...

CVE-2024-47084: Improper Authorization

Gradio is an open-source Python package designed for quick prototyping. This vulnerability is related to CORS origin validation, where the Gradio server fails to validate the request origin when a cookie is present. This allows an attacker’s website to make unauthorized requests to a local Gradio...

Cross Site Request Forgery (CSRF)

github.com/go-gitea/gitea is vulnerable to Cross Site Request Forgery CSRF. The vulnerability is due to the lack of proper validation and protection mechanisms in the API routes of Gitea, allows unauthorized state-altering POST requests to be executed by attackers on behalf of authenticated users...

Server Side Request Forgery (SSRF)

Mattermost is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to the omission of Oracle Cloud and Alibaba's metadata endpoints from the SSRF denylist, allowing attackers to exploit this gap for unauthorized requests...

BIT-ENVOY-2024-7207

A flaw was found in Envoy. It is possible to modify or manipulate headers from external clients when pass-through routes are used for the ingress gateway. This issue could allow a malicious user to forge what is logged by Envoy as a requested path and cause the Envoy proxy to make requests to...

Server Side Request Forgery (SSRF)

czim/file-handling is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper URL validation in the makeFromUrl and makeFromAny functions, allowing an attacker to make unauthorized requests or read local files...