Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2024-52803High· 7.5LLama Factory Remote OS Command Injection Vulnerability
LLama Factory Remote OS Command Injection Vulnerability
CVE-2024-11406Medium· 6.9django CMS Attributes Field Cross-site Scripting
django CMS Attributes Field Cross-site Scripting
CVE-2024-11404Medium· 5.5Django Filer Unrestricted Upload of File with Dangerous Type
Django Filer Unrestricted Upload of File with Dangerous Type
CVE-2024-52581High· 7.5Litestar allows unbounded resource consumption (DoS vulnerability)
Litestar allows unbounded resource consumption (DoS vulnerability)
CVE-2024-47533Critical· 9.8PoCcobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
CVE-2024-52304Medium· 5.9aiohttp: aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions (CVE-2024-52304)
A flaw was found in the aiohttp package. The Python parser parses newlines in chunk extensions incorrectly, which can lead to request smuggling vulnerabilities under certain conditions. If a pure Python version of aiohttp is installed, for…
CVE-2024-52303High· 7.5aiohttp: aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method (CVE-2024-52303)
A flaw was found in the aiohttp package. A memory leak can occur in certain configurations when a request produces a `MatchInfoError`. This issue was caused by adding an entry to a cache on each request due to the building of each `MatchIn…
CVE-2023-6110Medium· 5.5OpenStack improperly deletes access rules
OpenStack improperly deletes access rules
CVE-2021-3988Medium· 6.1Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
Cross-site Scripting (XSS) - DOM in janeczku/calibre-web
CVE-2021-3986Medium· 4.3Generation of Error Message Containing Sensitive Information in janeczku/calibre-web
Generation of Error Message Containing Sensitive Information in janeczku/calibre-web
CVE-2021-3987Medium· 5.4Improper Access Control in janeczku/calibre-web
Improper Access Control in janeczku/calibre-web
CVE-2024-45784High· 7.5Apache Airflow: Sensitive configuration values are not masked in the logs by default
Apache Airflow: Sensitive configuration values are not masked in the logs by default
RUSTSEC-2024-0401Medium· 5.3Denial of service because of stack overflow with malicious decompression input
Denial of service because of stack overflow with malicious decompression input
CVE-2024-52524MediumReDoS in giskard's transformation.py (GHSL-2024-324)
ReDoS in giskard's transformation.py (GHSL-2024-324)
CVE-2024-4311Medium· 5.4Missing ratelimit on passwrod resets in zenml
Missing ratelimit on passwrod resets in zenml
CVE-2023-34049Medium· 6.7Salt preflight script could be attacker controlled
Salt preflight script could be attacker controlled
CVE-2024-11079Medium· 5.5A flaw was found in Ansible-Core
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote da…
CVE-2024-27529High· 8.4wasm3 uncontrolled memory allocation vulnerability
wasm3 uncontrolled memory allocation vulnerability
CVE-2024-50378Medium· 6.5Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent Data
CVE-2024-51998High· 8.6changedetection.io path traversal using file URI scheme without supplying hostname
changedetection.io path traversal using file URI scheme without supplying hostname
GHSA-p7mv-53f2-4cwjHighCometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data
CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data
CVE-2024-9902Medium· 6.3PoCAnsible-core: ansible-core user may read/write unauthorized content
A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` modu…
CVE-2024-51756Nonecap-primitives doesn't fully sandbox all the Windows device filenames
cap-primitives doesn't fully sandbox all the Windows device filenames
CVE-2024-48061Critical· 9.8PoCLangflow vulnerable to remote code execution
Langflow vulnerable to remote code execution
CVE-2024-48052Medium· 6.5gradio Server Side Request Forgery vulnerability
gradio Server Side Request Forgery vulnerability
CVE-2024-51744Low· 3.1golang-jwt: Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (CVE-2024-517…
A flaw was found in the golang-jwt package. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are not checking errors in the way they should be. Especially, if a token is both expired and in…
CVE-2024-51734Critical· 9.1Access control vulnerable to user data deletion by anonynmous users
Access control vulnerable to user data deletion by anonynmous users
CVE-2024-51745NoneWasmtime doesn't fully sandbox all the Windows device filenames
Wasmtime doesn't fully sandbox all the Windows device filenames
CVE-2024-51483Medium· 6.5PoCchangedetection.io Path Traversal
changedetection.io Path Traversal
CVE-2024-8185High· 7.5Hashicorp Vault vulnerable to denial of service through memory exhaustion
Hashicorp Vault vulnerable to denial of service through memory exhaustion