Tagged “osv”
CVEs tagged osv, newest first.
7203 CVEsRSS
CVE-2023-46136Medium· 5.7PoCWerkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
CVE-2022-4886High· 8.8Ingress-nginx path sanitization can be bypassed
Ingress-nginx path sanitization can be bypassed
CVE-2023-5043High· 7.6PoCIngress nginx annotation injection causes arbitrary command execution
Ingress nginx annotation injection causes arbitrary command execution
CVE-2023-46134Medium· 6.1dtale vulnerable to Remote Code Execution through the Custom Filter Input
dtale vulnerable to Remote Code Execution through the Custom Filter Input
CVE-2023-43651Medium· 6.4Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell
Jumpserver Koko vulnerable to remote code execution on the host system via MongoDB shell
CVE-2023-46128High· 7.7Nautobot vulnerable to exposure of hashed user passwords via REST API
Nautobot vulnerable to exposure of hashed user passwords via REST API
CVE-2023-46125Medium· 6.5Fides Information Disclosure Vulnerability in Config API Endpoint
Fides Information Disclosure Vulnerability in Config API Endpoint
CVE-2023-46124High· 8.2Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
Fides Server-Side Request Forgery Vulnerability in Custom Integration Upload
CVE-2023-46126Low· 3.9Fides JavaScript Injection Vulnerability in Privacy Center URL
Fides JavaScript Injection Vulnerability in Privacy Center URL
CVE-2023-32785Critical· 9.8Langchain SQL Injection vulnerability
Langchain SQL Injection vulnerability
CVE-2023-32786High· 7.5Langchain Server-Side Request Forgery vulnerability
Langchain Server-Side Request Forgery vulnerability
CVE-2023-44690Mediummycli has Inadequate Encryption Strength
mycli has Inadequate Encryption Strength
CVE-2023-45805High· 7.8PDM Trojan Lockfile
PDM Trojan Lockfile
CVE-2023-47090HighNATS.io: Adding accounts for just the system account adds auth bypass
NATS.io: Adding accounts for just the system account adds auth bypass
CVE-2023-45813Medium· 4.6TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link
TorBot vulnerable to Inefficient Regular Expression Complexity in validate_link
CVE-2023-43802High· 7.3Arduino Create Agent path traversal - local privilege escalation vulnerability
Arduino Create Agent path traversal - local privilege escalation vulnerability
CVE-2023-43800High· 7.3Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability
Arduino Create Agent Insufficient Verification of Data Authenticity vulnerability
CVE-2023-45683High· 7.1Cross-site Scripting via missing Binding syntax validation
Cross-site Scripting via missing Binding syntax validation
CVE-2023-45803Medium· 4.2urllib3's request body not stripped after redirect from 303 status changes request method to GET
urllib3's request body not stripped after redirect from 303 status changes request method to GET
CVE-2023-41881Low· 3.7vantage6 does not properly delete linked resources when deleting a collaboration
vantage6 does not properly delete linked resources when deleting a collaboration
CVE-2023-45853Critical· 9.8⚖ disputedMiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field
MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pymini…
CVE-2023-23930High· 7.2Pickle serialization vulnerable to Deserialization of Untrusted Data
Pickle serialization vulnerable to Deserialization of Untrusted Data
CVE-2023-28635Medium· 5.4Defining resource name as integer may give unintended access in vantage6
Defining resource name as integer may give unintended access in vantage6
CVE-2023-4822Medium· 6.7grafana: incorrect assessment of permissions across organizations (CVE-2023-4822)
A flaw was found in the Grafana enterprise package. Grafana is incorrectly assessing permissions to update global roles and role assignments, therefore, users with administrator permissions in one organization can change global role permis…
CVE-2023-39325High· 7.5PoCHTTP/2 rapid reset can cause excessive work in net/http
HTTP/2 rapid reset can cause excessive work in net/http
CVE-2023-45129Medium· 4.9matrix-synapse vulnerable to denial of service due to malicious server ACL events
matrix-synapse vulnerable to denial of service due to malicious server ACL events
CVE-2023-20902Medium· 5.9Harbor timing attack risk
Harbor timing attack risk
CVE-2023-36566Medium· 6.5Microsoft Common Data Model SDK Denial of Service Vulnerability
Microsoft Common Data Model SDK Denial of Service Vulnerability
CVE-2023-32188CriticalJWT token compromise can allow malicious actions including Remote Code Execution (RCE)
JWT token compromise can allow malicious actions including Remote Code Execution (RCE)
CVE-2023-4570High· 8.8NI MeasurementLink Python Services Improper Access Restriction vulnerability
NI MeasurementLink Python Services Improper Access Restriction vulnerability