Advisory Catalog

Arbitrary Code Execution in blazar-dashboard

Out of bounds access in tensorflow-lite

Out of bounds write in tensorflow-lite

Data corruption in tensorflow-lite

Segfault and data corruption in tensorflow-lite

Data leak in Tensorflow

Integer truncation in Shard API usage

Heap buffer overflow in Tensorflow

Heap Overflow in PyMiniRacer

Integer overflow in the bundled Brotli C library

Scalyr Agent Missing SSL Certificate Validation

Scalyr Agent 2 Missing SSL Certificate Validation

Remote Code Execution in Red Discord Bot

openapi-python-client Arbitrary Code Generation vulnerability

Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer

**Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.

Command injection in Gerapy

Command injection via Celery broker in Apache Airflow

Insecure default config of Celery worker in Apache Airflow

Out-of-bounds read in Pillow

Improper Authentication in Apache Spark

Deserialization of Untrusted Data in Tendenci

Uncontrolled Resource Consumption in Indy Node

OS Command Injection in jw.util

** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__ makes an os.system call. NOTE: third parties dispute this issue because the read_pickle() function is documented as unsafe and it is the user's

scikit-learn Deserialization of Untrusted Data

Maltego incorrectly shares a MISP connection across users in a remote-transform use case

SaltStack Salt Unauthenticated Remote Code Execution

Improper Input Validation in PyYAML

SVGlib Vulnerable to XXE Attacks

GitHub personal access token leaking into temporary EasyBuild (debug) logs

Django Rest Framework jwt allows obtaining new token from notionally invalidated token

Potential buffer overflow in psd-tools

Improper Input Validation in Twisted

HTTP Request Smuggling in Twisted

Ansible Remote Code Execution

Ansible Code Injection Vulnerability

Deserialization of Untrusted Data in PyYAML

Ansible Arbitrary Code Execution

Ansible Arbitrary Code Execution

JGit Improper Input Validation vulnerability

Incorrect threshold signature computation in TUF

SQL injection in Django

Plone Unauthenticated Write Vulnerability

SaltStack Salt is vulnerable to command injection

Integer overflow in Pillow

Buffer Copy without Checking Size of Input in Pillow

PCX P mode buffer overflow in Pillow

Improper Verification of Cryptographic Signature in Pure-Python ECDSA

Duplicate Advisory: Inconsistent Interpretation of HTTP Requests in Waitress