Advisory Catalog

PaddlePaddle segfault in paddle.mode

PaddlePaddle null pointer dereference in paddle.nextafter

PaddlePaddle segfault in paddle.put_along_axis

PaddlePaddle floating point exception in paddle.topk

PaddlePaddle floating point exception in paddle.lerp

PaddlePaddle floating point exception in paddle.amin

PaddlePaddle nullptr dereference in paddle.crop

PaddlePaddle floating point exception in paddle.argmin and paddle.argmax

Gradio makes the `/file` secure against file traversal and server-side request forgery attacks

transformers has a Deserialization of Untrusted Data vulnerability

MLflow Local File Disclosure Vulnerability

MLflow Path Traversal Vulnerability

Expired tokens can be renewed without validating the account password

Apache Superset SQL injection vulnerability

Apache Superset incorrect write permissions vulnerability

mlflow Command Injection vulnerability

MLflow Path Traversal Vulnerability

Improper validation in meraki

incorrect storage layout for contracts containing large arrays

Path traversal in MLflow

Ansible template injection vulnerability

Jinja2 template injection in mlflow

Local Privilege Escalation in Windows

PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution

Information exposure in MLflow

Cookie leakage between different users in fastapi-proxy-lib

cryptography vulnerable to NULL-dereference when loading PKCS7 certificates

Apache Superset - Elevation of Privilege

Apache DolphinScheduler sensitive information disclosure

Cross-site Scripting potential in custom links, job buttons, and computed fields

Download to arbitrary folder can lead to RCE

upydev has weak encryption padding

HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack

Missing SSL certificate validation in localstack

PyPinkSign uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption

Cross-Site Request Forgery vulnerability in Prefect

AIOHTTP has problems in HTTP parser (the python one, not llhttp)

vantage6-server node accepts non-whitelisted algorithms from malicious server

Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task

Remarshal expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack

Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

AsyncSSH Rogue Session Attack

esptool allows attackers to view sensitive information via weak cryptographic algorithm

An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in Exiv2 version v0.28.0. The vulnerable function, `BmffImage::brotliUncompress`, is new in v0.28.0, so earlier versions of Exiv2 are _not_ aff

Django Denial of service vulnerability in django.utils.encoding.uri_to_iri

Django Denial-of-service in django.utils.text.Truncator

Pillow Denial of Service vulnerability

Django potential denial of service vulnerability in UsernameField on Windows

Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability