Alta
CVE-2024-23334
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 6.855
Restablecer filtros
Crítica
CVE-2024-0937
Deserialization of untrusted data in synthcity
Alta
CVE-2024-0936
A vulnerability classified as critical was found in van_der_Schaar LAB TemporAI 0.0.3. Affected by this vulnerability is the function load_from_file of the component PKL File Handler. The manipulation
Media
CVE-2023-51702
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Alta
CVE-2023-50943
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting r
Alta
CVE-2023-50944
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low s
Media
CVE-2024-23633
Cross-site Scripting Vulnerability on Data Import
Alta
CVE-2023-47115
Cross-site Scripting Vulnerability on Avatar Upload
Media
CVE-2024-23341
html injection vulnerability in the `tuitse_html` function.
Crítica
CVE-2023-49657
Cross-site Scripting in Apache superset
Alta
CVE-2024-23345
XSS potential in rendered Markdown fields (comments, description, notes, etc.)
Crítica
CVE-2024-23752
Code execution in pandasai
Crítica
CVE-2024-23751
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorS
Alta
CVE-2024-23750
MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprocess.Popen.
Crítica
CVE-2024-23730
Unsafe yaml deserialization in llama-hub
Media
CVE-2024-23732
The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.
Crítica
CVE-2024-23731
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
Baja
CVE-2024-23329
changedetection.io API endpoint is not secured with API token
Alta
CVE-2024-22419
concat built-in can corrupt memory in vyper
Crítica
CVE-2024-22416
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
Media
ghsa-xgfm-fjx6-62mj
readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects
Crítica
CVE-2023-46226
Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2.
Media
ghsa-8qw9-gf7w-42x5
Minor fix to previous patch for CVE-2022-35918
Crítica
CVE-2016-20021
In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file but does not perform signature verification. Unless emerge-we
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.