7326 matches found
ESPHome vulnerable to remote code execution via arbitrary file write
SummarySecurity misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 command line installation allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Details...
PaddlePaddle command injection in paddle.utils.download._wget_download
Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...
LibOSDP RMAC revert to the beginning of the session
- Issues: - SCS14 is allowed on encrypted connection osdpphy.c - No validation for RMACI is only in response to osdpSCRYPT osdpcp.c - Couldn't find anything specific in the OSDP specifications indicating it is forbidden, I'm gussing it shouldn't be allowed according from the secure connection...
LibOSDP vulnerable to a null pointer deref in osdp_reply_name
Issue:At ospdcommon.c, on the osdpreplyname function, any reply id between REPLYACK and REPLYXRD is valid, but names array do not declare all of the range. On a case of an undefined reply id within the range, name will be null name = namesreplyid - REPLYACK;. Null name will casue a crash on next...
WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
ImpactSince version 61.0, there's a vulnerability which allows attaching content of arbitrary files and URLs to a generated PDF document, even if urlfetcher is configured to prevent access to files and URLs. PatchesFixed by 734ee8e that’s included in 61.2 Workarounds- Check that no PDF attachment...
JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
Affected versionVendor: https://github.com/latchset/jwcryptoVersion: 1.5.5 DescriptionAn attacker can cause a DoS attack by passing in a malicious JWE Token with a high compression ratio.When the server processes this Token, it will consume a lot of memory and processing time. Pocpythonfrom...
Phone information disclosure vulnerability
Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request...
PaddlePaddle command injection vulnerability
Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0...
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue...
Apache Superset: Improper authorization validation on dashboards and charts import
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...
Apache Superset: Improper error handling on alerts
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert...
Apache Superset: Improper Neutralization of custom SQL on embedded context
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1 or 3.0.4, whic...
ZenML Server Remote Privilege Escalation Vulnerability
ZenML Server in the ZenML package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. These are also patched versions: 0.44.4,...
Docassemble HTML and javascript injection
ImpactA user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The HTML can also contain...
Docassemble unauthorized access through URL manipulation
ImpactThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. PatchesThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched...
Apache Superset: Improper data authorization when creating a new dataset
Apache Superset with custom roles that include can write on dataset and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use those virtual datasets to get access to unauthorized data.This issue affects Apach...
Mezzanine allows attackers to bypass access controls via manipulating the Host header
An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header...
Mezzanine allows attackers to bypass access control mechanisms
An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...
Docassemble open redirect
ImpactIt is possible to create a URL that acts as an open redirect. PatchesThe vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched. WorkaroundsIf upgrading is not possible, manually apply the changes of 4801ac7 and restart the serv...
Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)
ImpactA Cross-Site Scripting XSS vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser.Impacted...
Scrapy decompression bomb vulnerability
ImpactScrapy limits allowed response sizes by default through the DOWNLOADMAXSIZE and DOWNLOADWARNSIZE settings.However, those limits were only being enforced during the download of the raw, usually-compressed response bodies, and not during decompression, making Scrapy vulnerable to decompressio...
Allegro AI ClearML vulnerable to deserialization of untrusted data
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with...
python-multipart vulnerable to Content-Type Header ReDoS
SummaryWhen using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...
Scrapy authorization header leakage on cross-domain redirect
ImpactWhen you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain.Th...
Potentially untrusted input is rendered as HTML in final output
ImpactAll users of mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input like would be rendered as...
Gradio apps vulnerable to timing attacks to guess password
ImpactThis security policy is with regards to a timing attack that allows users of Gradio apps to potentially guess the password of password-protected Gradio apps. This relies on the fact that string comparisons in Python terminate early, as soon as there is a string mismatch. Because Gradio apps...
Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaking all user emails and passwords...
pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
SummaryOpen redirect vulnerability due to incorrect validation of input values when redirecting users after login. Detailspyload is validating URLs via the getredirecturl function when redirecting users at login.The URL entered in the next variable goes through the issafeurl function, where a lac...
Kinto Attachment's attachments can be replaced on read-only records
ImpactThe attachment file of an existing record can be replaced if the user has "read" permission on one of the parent collection or bucket.And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous...
langchain Server-Side Request Forgery vulnerability
With the following crawler configuration:pythonfrom bs4 import BeautifulSoup as Soupurl = "https://example.com"loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.loadAn attacker in control of the contents of https://example.com could place...
Allegro AI ClearML path traversal vulnerability
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...
Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...
m2crypto Bleichenbacher timing attack - incomplete fix for CVE-2020-25657
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...
vantage6 has insecure SSH configuration for node and server containers
ImpactNodes and servers get a ssh config by default that permits root login with password authentication. In a proper deployment, the SSH service is not exposed so there is no risk, but not all deployments are ideal. The default should therefore be less permissive.We will probably opt to complete...
ai-flow Deserialization of Untrusted Data vulnerability
A vulnerability was found in flink-extended ai-flow 0.3.1. It has been declared as critical. Affected by this vulnerability is the function cloudpickle.loads of the file \aiflow\cli\commands\workflowcommand.py. The manipulation leads to deserialization. The attack can be launched remotely. The...
vantage6 vulnerable to username timing attack
ImpactIt is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks WorkaroundsNo...
glance-store logs s3 access keys
A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an...
Null pointer dereference in PKCS12 parsing
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSLto crash leading to a potential Denial of Service attackImpact summary: Applications loading files in the PKCS12 format from untrustedsources might terminate abruptly.A file in PKCS12 format can contain certificates and...
Path traversal in flaskcode
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a POST request to a /update-resource-data/ URI from views.py, allows attackers to write to arbitrary files...
Cross-Frame Scripting vulnerability has been found on Plone CMS
A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element...
JupyterLab vulnerable to potential authentication and CSRF tokens leak
ImpactUsers of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. PatchesJupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. WorkaroundsNo workaround has been identified, however users...
Minerva timing attack on P-256 in python-ecdsa
python-ecdsa has been found to be subject to a Minerva timing attack on the P-256 curve. Using the ecdsa.SigningKey.signdigest API function and timing signatures an attacker can leak the internal nonce which may allow for private key discovery. Both ECDSA signatures, key generation, and ECDH...
Unsecured endpoints in the jupyter-lsp server extension
ImpactInstallations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with jupyter-server instances exposed to non-trusted network are vulnerable to unauthorised access and modification of file system beyond the jupyter root...
JupyterLab vulnerable to SXSS in Markdown Preview
ImpactThe vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature.A malicious user can access any data that the attacked user has access to as well as perform arbitrary requests acting as the attacked user...
Privilege escalation for users that can access mock configuration
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja2 templates, whic...
Path traversal in flaskcode
An issue was discovered in the flaskcode package through 0.0.8 for Python. An unauthenticated directory traversal, exploitable with a GET request to a /resource-data/.txt URI from views.py, allows attackers to read arbitrary files...
Apache Superset SQL injection vulnerability
A wherein JINJA macro allows users to specify a quote, which combined with a carefully crafted statementwould allow for SQL injectionin Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2.Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes...
D-Tale server-side request forgery through Web uploads
ImpactUsers hosting D-Tale publicly can be vulnerable to server-side request forgery SSRF allowing attackers to access files on the server. PatchesUsers should upgrade to version 3.9.0 where the "Load From the Web" input is turned off by default. You can find out more information on how to turn i...