Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2024-9902Medium· 6.3PoCAnsible-core: ansible-core user may read/write unauthorized content
A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` modu…
CVE-2024-48061Critical· 9.8PoCLangflow vulnerable to remote code execution
Langflow vulnerable to remote code execution
CVE-2024-48052Medium· 6.5gradio Server Side Request Forgery vulnerability
gradio Server Side Request Forgery vulnerability
CVE-2024-51734Critical· 9.1Access control vulnerable to user data deletion by anonynmous users
Access control vulnerable to user data deletion by anonynmous users
CVE-2024-51483Medium· 6.5PoCchangedetection.io Path Traversal
changedetection.io Path Traversal
CVE-2024-8309Medium· 4.9PoCLangchain SQL Injection vulnerability
Langchain SQL Injection vulnerability
CVE-2024-49767High· 7.5Werkzeug possible resource exhaustion when parsing file data in forms
Werkzeug possible resource exhaustion when parsing file data in forms
CVE-2024-49766MediumWerkzeug safe_join not safe on Windows
Werkzeug safe_join not safe on Windows
CVE-2024-49750Medium· 5.5The Snowflake Connector for Python stores sensitive data in logs
The Snowflake Connector for Python stores sensitive data in logs
CVE-2024-24826Medium· 5.5Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder
Exiv2 has an out-of-bounds read in QuickTimeVideo::NikonTagsDecoder
CVE-2024-25112Medium· 5.5Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
Exiv2 has a denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder
CVE-2024-10073Medium· 5.0Flair allows arbitrary code execution
Flair allows arbitrary code execution
CVE-2024-32651Critical· 10.0PoCchangedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
CVE-2024-21272High· 7.5MySQL Connector/Python connector takeover vulnerability
MySQL Connector/Python connector takeover vulnerability
CVE-2024-47874High· 7.5⚖ disputedstarlette: Starlette Denial of service (DoS) via multipart/form-data (CVE-2024-47874)
A flaw was found in Starlette. Starlette treats multipart/form-data parts without a filename as text form fields and buffers those in byte strings with no size limit. This flaw allows an attacker to upload arbitrary large form fields and c…
CVE-2024-6971Low· 3.4Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
GHSA-26jh-r8g2-6fprMedium· 5.3Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list
Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list
CVE-2024-7041Medium· 6.5open-webui Insecure Direct Object Reference (IDOR) vulnerability
open-webui Insecure Direct Object Reference (IDOR) vulnerability
CVE-2024-7038Low· 2.7Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-7037Medium· 6.5Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-45231Low· 3.7Django allows enumeration of user e-mail addresses
Django allows enumeration of user e-mail addresses
CVE-2024-25885Medium· 5.3xhtml2pdf Denial of Service via crafted string
xhtml2pdf Denial of Service via crafted string
CVE-2024-47211Medium· 5.3OpenStack Ironic fails to verify checksums of supplied image_source URLs
OpenStack Ironic fails to verify checksums of supplied image_source URLs
CVE-2024-9277Low· 3.5Inefficient Regular Expression Complexity in langflow
Inefficient Regular Expression Complexity in langflow
CVE-2024-1728High· 8.1PoCGradio allows users to access arbitrary files
Gradio allows users to access arbitrary files
CVE-2024-46488Critical· 9.1Heap-based Buffer Overflow in sqlite-vec
Heap-based Buffer Overflow in sqlite-vec
CVE-2024-9014High· 8.6PoCOAuth2 client ID and secret exposed through the web browser
OAuth2 client ID and secret exposed through the web browser
CVE-2024-47226Medium· 5.4A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel …
A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel via a /core/config-revisions/ Add action. An authenticated user can inject arbitrary JavaScript or H…
CVE-2024-45793Medium· 4.8Prevent XSS from Confidant API call
Prevent XSS from Confidant API call
CVE-2024-46946Critical· 9.8LangChain Experimental Eval Injection vulnerability
LangChain Experimental Eval Injection vulnerability