Tagged “osv”
CVEs tagged osv, newest first.
7207 CVEsRSS
CVE-2023-49297Low· 3.3PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution
PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution
CVE-2023-49080Medium· 4.3jupyter-server errors include tracebacks with path information
jupyter-server errors include tracebacks with path information
CVE-2023-47106Medium· 6.5Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
Traefik incorrectly processes fragment in the URL, leads to Authorization Bypass
CVE-2023-47124Medium· 5.9Traefik vulnerable to potential DDoS via ACME HTTPChallenge
Traefik vulnerable to potential DDoS via ACME HTTPChallenge
CVE-2023-47633High· 7.5Traefik docker container using 100% CPU
Traefik docker container using 100% CPU
CVE-2023-6180Medium· 5.3tokio-boring vulnerable to resource exhaustion via memory leak
tokio-boring vulnerable to resource exhaustion via memory leak
CVE-2023-43472High· 7.5PoCInformation exposure in MLflow
Information exposure in MLflow
CVE-2023-49277Medium· 6.1Reflected XSS Vulnerability in dpaste
Reflected XSS Vulnerability in dpaste
CVE-2023-49081High· 7.2aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker co…
CVE-2023-49097High· 8.1ZITADEL Account Takeover via Malicious Host Header Injection
ZITADEL Account Takeover via Malicious Host Header Injection
CVE-2023-49082Medium· 5.3aiohttp is an asynchronous HTTP client/server framework for asyncio and Python
aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP request (e.g. insert a new header) or even create a new HTTP request if the attacker…
CVE-2023-49083Medium· 5.9cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
cryptography vulnerable to NULL-dereference when loading PKCS7 certificates
CVE-2023-48022Critical· 9.8PoCRay has arbitrary code execution via jobs submission API
Ray has arbitrary code execution via jobs submission API
CVE-2023-42502Medium· 5.4Apache Superset Open Redirect vulnerability
Apache Superset Open Redirect vulnerability
CVE-2023-42505Medium· 4.3Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
CVE-2023-40610High· 7.3Apache Superset - Elevation of Privilege
Apache Superset - Elevation of Privilege
CVE-2023-42504Medium· 6.5Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
CVE-2023-6202Medium· 4.3Mattermost Improper Access Control vulnerability
Mattermost Improper Access Control vulnerability
CVE-2023-47168Medium· 4.3Mattermost Open Redirect vulnerability
Mattermost Open Redirect vulnerability
CVE-2023-48369Medium· 5.3Mattermost Uncontrolled Resource Consumption vulnerability
Mattermost Uncontrolled Resource Consumption vulnerability
GHSA-pjjw-qhg8-p2p9Mediumaiohttp has vulnerable dependency that is vulnerable to request smuggling
aiohttp has vulnerable dependency that is vulnerable to request smuggling
CVE-2023-43701Medium· 4.3Apache Superset Cross-site Scripting vulnerability
Apache Superset Cross-site Scripting vulnerability
CVE-2023-42501Medium· 4.3Apache Superset has Incorrect Default Permissions
Apache Superset has Incorrect Default Permissions
CVE-2023-42811Medium· 4.7Plaintext exposed in decrypt_in_place_detached even on tag verification failure
Plaintext exposed in decrypt_in_place_detached even on tag verification failure
CVE-2023-49092Medium· 5.9Marvin Attack: potential key recovery through timing sidechannels
Marvin Attack: potential key recovery through timing sidechannels
GHSA-2c7c-3mj9-8fqhMediumDecryption of malicious PBES2 JWE objects can consume unbounded system resources
Decryption of malicious PBES2 JWE objects can consume unbounded system resources
CVE-2023-48699High· 8.4Eval Injection in fastbots
Eval Injection in fastbots
CVE-2023-48700Medium· 5.7Clear Text Credentials Exposed via Onboarding Task
Clear Text Credentials Exposed via Onboarding Task
CVE-2023-48299Medium· 5.3TorchServe ZipSlip
TorchServe ZipSlip
CVE-2023-47890High· 7.6Download to arbitrary folder can lead to RCE
Download to arbitrary folder can lead to RCE