Advisory Catalog

TensorFlow has Heap-buffer-overflow in AvgPoolGrad

TensorFlow has a heap out-of-buffer read vulnerability in the QuantizeAndDequantize operation

mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

weixin-python XML External Entity vulnerability

Apache Airflow Hive Provider Improper Input Validation vulnerability

Apache Airflow Sqoop Provider Improper Input Validation vulnerability

Apache Airflow Google Provider Improper Input Validation vulnerability

Update share links to use FRP instead of SSH tunneling

Nautobot vulnerable to remote code execution via Jinja2 template rendering

Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/modules/status.py file.

No protection against brute-force attacks on login page

Authentication Bypass in modoboa

Header injection in TurboGears

Excessive Attack Surface in pyload-ng

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Code Injection in pyload-ng

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions.

rdiffweb vulnerable to Business Logic Errors

rdiffweb Improper Access Control vulnerability

Apache Airflow Hive Provider vulnerable to Command Injection

Patchelf out-of-bounds read

Improper Privilege Management in rdiffweb

PaddlePaddle vulnerable to Code Injection

PaddlePaddle Out-of-bounds Read vulnerability

py7zr directory traversal vulnerability

GitPython vulnerable to Remote Code Execution due to improper user input validation

PaddlePaddle vulnerable to code injection via winstr

PyTorch vulnerable to arbitrary code execution

wger vulnerable to brute force attempts

OS Command Injection in Apache Airflow

OS Command Injection in Apache Airflow

Heap overflow in `QuantizeAndDequantizeV2`

Out of bounds write in grappler in Tensorflow

FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess

Tensorflow vulnerable to Out-of-Bounds Read

rdiffweb vulnerable to Insufficient Session Expiration

Arches vulnerable to execution of arbitrary SQL

acryl-datahub missing JWT signature check

Rdiffweb subject to Business Logic Errors

Improper Control of Generation of Code ('Code Injection') in Azure CLI

Buffer overflow in sponge queue functions

Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control

Rdiffweb is missing authentication for critical function

Missing rate limit on rdiffweb

Missing rate limit on rdiffweb

Origin Validation Error in rdiffweb

The d8s-yaml package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-utility package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-json package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.

The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.