Advisory Catalog

Unsecured endpoints in the jupyter-lsp server extension

Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

Privilege escalation for users that can access mock configuration

Remote Code Execution vulnerability in Apache IoTDB via UDF

Gentoo Portage missing PGP validation of executed code

Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC

PaddlePaddle stack overflow in paddle.searchsorted

PaddlePaddle stack overflow in paddle.linalg.lu_unpack

PaddlePaddle heap buffer overflow in paddle.repeat_interleave

PaddlePaddle command injection in get_online_pass_interval

PaddlePaddle command injection in _wget_download

PaddlePaddle command injection in convert_shape_compare

A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The p

MLFlow Path Traversal Vulnerability

MLflow Server-Side Request Forgery (SSRF)

transformers has a Deserialization of Untrusted Data vulnerability

GitHub Security Lab (GHSL) Vulnerability Report: Arbitary write GHSL-2023-182

Path traversal in MLflow

Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability

External Control of File Name or Path in h2oai/h2o-3

Improper Privilege Management in sap-xssec

Ray has arbitrary code execution via jobs submission API

SQL injection in Apache Submarine

Eval Injection in fastbots

Deserialization of Untrusted Data in apache-submarine

Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file

Ray Missing Authorization vulnerability

MLflow authentication requirement bypass can allow a user to arbitrarily create an account

Ray Path Traversal vulnerability

Ray OS Command Injection vulnerability

Remote Code Execution due to Full Controled File Write in mlflow

MLflow allowed arbitrary files to be PUT onto the server

Ethyca Fides Cryptographically Weak Generation of One-Time Codes for Identity Verification

piccolo SQL Injection via named transaction savepoints

Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session Tokens

PyArrow: Arbitrary code execution when loading a malicious data file

transmute-core unsafe YAML deserialization vulnerability

dtale vulnerable to Remote Code Execution through the Custom Filter Input

Langchain SQL Injection vulnerability

modoboa Cross-site Scripting vulnerability

pyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency

langchain_experimental vulnerable to arbitrary code execution via PALChain in the python exec method

TorchServe Pre-Auth Remote Code Execution

TorchServe Server-Side Request Forgery vulnerability

pydash Command Injection vulnerability

Searchor CLI's Search vulnerable to Arbitrary Code using Eval

Gevent allows remote attacker to escalate privileges

ReportLab vulnerable to remote code execution via paraparser

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

Heap-based buffer overflow in ZBar