Media
ghsa-hfmc-7525-mj55
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.319
Restablecer filtros
Crítica
CVE-2023-6569
External Control of File Name or Path in h2oai/h2o-3
Alta
ghsa-7vwr-g6pm-9hc8
Cookie leakage between different users in fastapi-proxy-lib
Crítica
ghsa-x563-6hqv-26mr
Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file
Media
CVE-2023-47627
AIOHTTP has problems in HTTP parser (the python one, not llhttp)
Alta
CVE-2023-46446
AsyncSSH Rogue Session Attack
Media
CVE-2023-46445
AsyncSSH Rogue Extension Negotiation
Alta
CVE-2023-47117
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
Media
CVE-2023-47037
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.
Media
CVE-2023-46136
Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Media
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
Alta
CVE-2023-45815
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Media
CVE-2023-45803
urllib3's request body not stripped after redirect from 303 status changes request method to GET
Media
CVE-2023-28635
Defining resource name as integer may give unintended access in vantage6
Crítica
ghsa-4mqg-h5jf-j9m7
TorchServe Pre-Auth Remote Code Execution
Crítica
CVE-2023-26145
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to targ
Media
CVE-2023-41048
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit
Alta
CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
Crítica
CVE-2019-19450
ReportLab vulnerable to remote code execution via paraparser
Alta
CVE-2023-42443
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Media
CVE-2023-41885
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Media
CVE-2023-40611
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could hav
Media
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unrespons
Media
CVE-2023-40170
cross-site inclusion (XSSI) of files in jupyter-server
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.