gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling at…

▾ Twilightchuanhuchatgpt · chuanhuchatgptEPSS 0.78%via OSV

CVE-2024-22423High· 8.3

2y ago

yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

▾ Twilightyt-dlp · yt-dlpEPSS 1.4%via OSV

CVE-2024-2196High· 8.8

2y ago

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations

▾ Twilightaim · aimEPSS 0.59%via OSV

Tagged “pip”

pyLoad allows upload to arbitrary folder lead to RCE

social-auth-app-django affected by Improper Handling of Case Sensitivity

Synapse V2 state resolution weakness allows Denial of Service (DoS)

OpenStack Storlets arbitrary code execution vulnerability

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider

flask-cors vulnerable to log injection when the log level is set to debug

aiohttp Cross-site Scripting vulnerability on index pages for static file handling

Sentry vulnerable to leaking superuser cleartext password in logs

Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

PyTorch heap buffer overflow vulnerability

Insecure deserialization in BentoML

Request smuggling leading to endpoint restriction bypass in Gunicorn

langchain vulnerable to path traversal

gradio Server-Side Request Forgery vulnerability

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

gradio vulnerable to Path Traversal

mlflow Path Traversal vulnerability

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

Pydantic regular expression denial of service

sqlparse parsing heavily nested list leads to Denial of Service

NiceGUI allows potential access to local file system

OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack

Internationalized Domain Names in Applications (IDNA) vulnerable to denial of service from specially crafted inputs to idna.encode

llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

Aim Web API vulnerable to Remote Code Execution

gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnera…

yt-dlp: `--exec` command injection when using `%q` in yt-dlp on Windows (Bypass of CVE-2023-40581)

Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations