Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2024-53948Medium· 5.3Apache Superset: Error verbosity exposes metadata in analytics databases
Apache Superset: Error verbosity exposes metadata in analytics databases
CVE-2024-53908Critical· 9.8Django SQL injection in HasKey(lhs, rhs) on Oracle
Django SQL injection in HasKey(lhs, rhs) on Oracle
CVE-2024-53907High· 7.5Django denial-of-service in django.utils.html.strip_tags()
Django denial-of-service in django.utils.html.strip_tags()
CVE-2024-53856High· 7.5Panics on Malformed Untrusted Input
Panics on Malformed Untrusted Input
CVE-2024-54132MediumDownloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
Downloading malicious GitHub Actions workflow artifact results in path traversal vulnerability
CVE-2024-39163High· 8.8pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints
pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints
CVE-2024-53257Medium· 4.9Vitess allows HTML injection in /debug/querylogz & /debug/env
Vitess allows HTML injection in /debug/querylogz & /debug/env
CVE-2024-53863HighSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
CVE-2024-52805HighSynapse allows unsupported content types to lead to memory exhaustion
Synapse allows unsupported content types to lead to memory exhaustion
CVE-2024-52815HighSynapse allows a a malformed invite to break the invitee's `/sync`
Synapse allows a a malformed invite to break the invitee's `/sync`
CVE-2024-53999Medium· 6.1Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
CVE-2024-53867Medium· 4.3Synapse Matrix has a partial room state leak via Sliding Sync
Synapse Matrix has a partial room state leak via Sliding Sync
CVE-2024-53848High· 7.1check-jsonschema default caching for remote schemas allows for cache confusion
check-jsonschema default caching for remote schemas allows for cache confusion
CVE-2024-53865High· 8.2Python package "zhmcclient" stores passwords in clear text in its HMC and API logs
Python package "zhmcclient" stores passwords in clear text in its HMC and API logs
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
Denial of service (DoS) via deformation `multipart/form-data` boundary
CVE-2024-36621Medium· 6.5Moby Race Condition vulnerability
Moby Race Condition vulnerability
CVE-2024-39162Medium· 6.1pyspider Cross-site Scripting vulnerability
pyspider Cross-site Scripting vulnerability
CVE-2024-53861Low· 2.2pyjwt: Issuer field partial matches allowed in pyjwt (CVE-2024-53861)
A flaw was found in the pyJWT package. An incorrect string comparison is run for `iss` checking, which allows for partial matches. This results in `if "abc" not in "__abcd__":` being checked instead of `if "abc" != "__abc__":`. Signature c…
CVE-2024-53859Medium· 6.5`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace
CVE-2024-52008Medium· 5.7Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
RUSTSEC-2024-0448None`parse_arguments` reads a caller-supplied pointer as a slice
`parse_arguments` reads a caller-supplied pointer as a slice
CVE-2024-53916High· 7.5OpenStack Neutron can use an incorrect ID during policy enforcement
OpenStack Neutron can use an incorrect ID during policy enforcement
CVE-2024-52787Critical· 9.1libre-chat Path Traversal vulnerability
libre-chat Path Traversal vulnerability
CVE-2024-53899High· 7.8virtualenv: potential command injection via virtual environment activation scripts (CVE-2024-53899)
A flaw was found in the virtualenv Python package. Due to the improper handling of quotes in magic template strings, the virtual environment activation script is vulnerable to OS command injection,leading to the loss of confidentiality,int…
CVE-2024-10220High· 8.1PoCKubernetes kubelet arbitrary command execution
Kubernetes kubelet arbitrary command execution
CVE-2024-11393High· 8.80dayPoCtransformers: Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11…
A flaw was found in the MaskFormer model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attac…
CVE-2024-11392High· 7.50dayPoCtransformers: Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11392)
A flaw was found in the MobileViTV2 model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an atta…
CVE-2024-11394High· 8.80dayPoCtransformers: Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVE-2024-11394)
A flaw was found in the Trax model of the Hugging Face Transformers library. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. This flaw allows an attacker to…
CVE-2024-52804High· 7.5Tornado has an HTTP cookie parsing DoS vulnerability
Tornado has an HTTP cookie parsing DoS vulnerability
CVE-2023-40017High· 7.5GeoNode Server Side Request forgery
GeoNode Server Side Request forgery