Advisory Catalog

Apache Airflow Incorrect Authorization vulnerability

Apache Airflow information exposure vulnerability

The Create Single Payment application of SAP S/4HANA - versions 100, 101, 102, 103, 104, 105, 106, 107, 108, allows an attacker to upload the XML file as an attachment. When clicked on the XML file in the attachment section, the file gets opened in the browser to cause the entity loops to slow down

Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio webhooks, proxy and recorder modes

Remote Code Execution in Custom Integration Upload

Information disclosure in AccessControl

Apache Superset Improper Input Validation vulnerability

Apache Superset Deserialization of Untrusted Data vulnerability

Apache Superset has incorrect authorization check

Apache Superset may expose internal traces on REST API endpoints

Apache Superset Server Side Request Forgery vulnerability

Apache Superset has improper default REST API permission for Gamma users

Apache Superset users may incorrectly create resources using the import charts feature

Apache Superset vulnerable to improper data authorization

Salt vulnerable to denial of service

Salt can cause Git Providers to get wrong data

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

incorrect order of evaluation of side effects for some builtins

Vyper: reversed order of side effects for some operations

Langchain vulnerable to arbitrary code execution via the evaluate function in the numexpr library

GitPython blind local file inclusion

Archive spoofing vulnerability in borgbackup

Sandbox escape via various forms of "format".

Heap-based buffer overflow in ZBar

Open Redirect Vulnerability in jupyter-server

cross-site inclusion (XSSI) of files in jupyter-server

GitPython untrusted search path on Windows systems leading to arbitrary code execution

Airflow Sqoop Provider RCE Vulnerability

Apache Airflow vulnerable arbitrary code execution via Spark server

Pyramid static view path traversal up one directory

Keylime registrar and (untrusted) Agent can be bypassed by an attacker

GeoNode Server Side Request forgery

Apache Airflow missing Certificate Validation

Apache Airflow denial of service vulnerability

Apache Airflow Session Fixation vulnerability

json2xml Uncaught Exception vulnerability

Horizon Web Dashboard Open Redirect vulnerability

langchain vulnerable to arbitrary code execution

Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.

Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated users

pandasai vulnerable to prompt injection

Apache Airflow Spark Provider Improper Input Validation vulnerability

PandasAI vulnerable to arbitrary code execution