7798 matches found
@debridge-finance/solana-contracts-client (>=0.1.0, <=1.0.0), @debridge-finance/solana-utils (1.0.2) potentially affected by CVE-2024-30253 via @solana/web3.js (1.62.0)
@solana/web3.js NPM version 1.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on @solana/web3.js and may be impacted: - @debridge-finance/solana-contracts-client =0.1.0, =1.0.0 - @debridge-finance/solana-utils 1.0.2 Source cves: CVE-2024-30253 Source...
OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt
Security researchers have uncovered a "credible" takeover attempt targeting the OpenJS Foundation in a manner that evokes similarities to the recently uncovered incident aimed at the open-source XZ Utils project. "The OpenJS Foundation Cross Project Council received a suspicious series of emails...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-3573 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-3573 Source advisory: OSV:GHSA-HQ88-WG7Q-GP4G...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1594 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1594 Source advisory: OSV:GHSA-M49C-5C52-6696...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1593 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1593 Source advisory: OSV:GHSA-F42M-MVFV-CGW5...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1558 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1558 Source advisory: OSV:GHSA-J62R-WXQQ-F3GF...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1560 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1560 Source advisory: OSV:GHSA-5MVJ-WMGJ-7Q8C...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-1483 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-1483 Source advisory: OSV:GHSA-F82R-JJ5R-6G97...
hip-data-ml-utils (>=0.3.7, <=1.0.0), mllibprodest (>=1.5.0, <=1.5.1) +1 more potentially affected by CVE-2024-3573 via mlflow (1.29.0)
mlflow PYPI version 1.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - hip-data-ml-utils =0.3.7, =1.5.0, =0.2.33, =0.2.39 Source cves: CVE-2024-3573 Source advisory: OSV:PYSEC-2024-243...
XZ Utils supply chain attack
Red Hat team released a security advisory for a supply chain compromise discovered in the XZ Utils library versions 5.6.0 and 5.6.1. The issue was assigned CVE-2024-3094. Acronis security team concluded that Acronis infrastructure and products are not affected by this vulnerability...
Popular Rust Crate liblzma-sys Compromised with XZ Utils Backdoor Files
"Test files" associated with the XZ Utils backdoor have made their way to a Rust crate known as liblzma-sys, new findings from Phylum reveal. liblzma-sys, which has been downloaded over 21,000 times to date, provides Rust developers with bindings to the liblzma implementation, an underlying libra...
USN-6730-1 maven-shared-utils vulnerability
It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...
USN-6730-1: Apache Maven Shared Utils vulnerability
It was discovered that Apache Maven Shared Utils did not handle double-quoted strings properly, allowing shell injection attacks. This could allow an attacker to run arbitrary code...
Backdoor in XZ Utils That Almost Happened
Last week, the Internet dodged a major nation-state attack that would have had catastrophic cybersecurity repercussions worldwide. It’s a catastrophe that didn’t happen, so it won’t get much attention--but it should. There’s an important moral to the story of the attack and its discovery: The...
GHSA-WVPX-G427-Q9WC llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
shadow-utils Incorrect Authentication Unauthorized Access
The vulnerability of the shadow-utils package is related to the double password request and the lack of buffer memory cleanup. Exploiting this vulnerability can allow an attacker to gain unauthorized access to user passwords...
LlamaIndex code injection vulnerability
LlamaIndex is a data framework for an LLM application by the individual developer Jerry Liu. A code injection vulnerability exists in LlamaIndex that stems from insufficient input validation of the safeeval function in executils, which allows injection at the prompt, leading to arbitrary code...
ROS-20240409-07
A vulnerability in the shadow-utils package is related to requesting the password twice and not clearing the memory buffer. Exploitation of the vulnerability could allow an attacker to gain access to the device...
USN-6658-1: libxml2 vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 22.04 Description It was discovered that libxml2 incorrectly handled certain XML documents. A remote attacker could possibly use this issue to cause libxml2 to crash, resulting in a denial of service, or possibly execute...
