Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2023-50711Medium· 5.7`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory access
CVE-2023-51663Medium· 5.3Hail relies on OIDC email claims to verify the validity of a user's domain.
Hail relies on OIDC email claims to verify the validity of a user's domain.
CVE-2023-49568High· 7.5Maliciously crafted Git server replies can cause DoS on go-git clients
Maliciously crafted Git server replies can cause DoS on go-git clients
CVE-2023-51449High· 8.6PoCGradio makes the `/file` secure against file traversal and server-side request forgery attacks
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
CVE-2023-6976High· 8.8MLflow Path Traversal Vulnerability
MLflow Path Traversal Vulnerability
CVE-2023-6977High· 7.5PoCMLflow Local File Disclosure Vulnerability
MLflow Local File Disclosure Vulnerability
GHSA-7ww5-4wqc-m92cMediumcontainerd allows RAPL to be accessible to a container
containerd allows RAPL to be accessible to a container
CVE-2023-49736Medium· 6.5Apache Superset SQL injection vulnerability
Apache Superset SQL injection vulnerability
CVE-2023-6940High· 8.8mlflow Command Injection vulnerability
mlflow Command Injection vulnerability
CVE-2023-49734High· 7.7Apache Superset incorrect write permissions vulnerability
Apache Superset incorrect write permissions vulnerability
CVE-2023-46104Medium· 6.5Apache Superset uncontrolled resource consumption
Apache Superset uncontrolled resource consumption
CVE-2023-5115Medium· 6.3Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the ex…
CVE-2023-48795Medium· 5.9PoCThe SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), a…
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), a…
CVE-2023-50715Medium· 4.3User accounts disclosed to unauthenticated actors on the LAN
User accounts disclosed to unauthenticated actors on the LAN
CVE-2023-6569Critical· 9.3External Control of File Name or Path in h2oai/h2o-3
External Control of File Name or Path in h2oai/h2o-3
CVE-2023-6572Critical· 9.6PoCGradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-50263Low· 3.7Unauthenticated db-file-storage views
Unauthenticated db-file-storage views
CVE-2023-46247High· 7.5incorrect storage layout for contracts containing large arrays
incorrect storage layout for contracts containing large arrays
CVE-2023-6193Medium· 5.3Unbounded queuing of path validation messages in cloudflare-quiche
Unbounded queuing of path validation messages in cloudflare-quiche
CVE-2023-50422Critical· 9.1Improper Privilege Management in github.com/sap/cloud-security-client-go
Improper Privilege Management in github.com/sap/cloud-security-client-go
CVE-2023-50248Medium· 4.5Out of memory error when submitting the dataset form with a specially-crafted field
Out of memory error when submitting the dataset form with a specially-crafted field
CVE-2023-50423Critical· 9.1Improper Privilege Management in sap-xssec
Improper Privilege Management in sap-xssec
CVE-2023-49795Medium· 6.5Server-Side Request Forgery in mindsdb
Server-Side Request Forgery in mindsdb
CVE-2023-35625Medium· 4.7Exposure of Sensitive Information in mltable
Exposure of Sensitive Information in mltable
CVE-2023-5764High· 7.1Ansible: template injection
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce…
CVE-2023-48311Medium· 4.3DockerSpawner allows any image by default
DockerSpawner allows any image by default
CVE-2023-6458High· 7.1Mattermost Injection vulnerability
Mattermost Injection vulnerability
CVE-2023-6459Medium· 5.3Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Mattermost Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-26154Medium· 5.9pubnub Insufficient Entropy vulnerability
pubnub Insufficient Entropy vulnerability
CVE-2023-49290Medium· 5.3lestrrat-go/jwx's malicious parameters in JWE can cause a DOS
lestrrat-go/jwx's malicious parameters in JWE can cause a DOS