Media
CVE-2023-25504
Archivo de vulnerabilidades
Conoce las vulnerabilidades. Protege tus aplicaciones.
Descubre qué vulnerabilidades afectan a tus tecnologías y cómo solucionarlas. Encuentra explicaciones claras, versiones afectadas y recomendaciones prácticas - desde CMS y plugins hasta bibliotecas de aplicaciones.
Archivo de vulnerabilidades 1.984
Restablecer filtros
Media
CVE-2023-36830
SQLFluff users with access to config file, using `libary_path` may call arbitrary python code
Alta
CVE-2023-36827
ethyca-fides Webserver API Path Traversal vulnerability
Alta
CVE-2023-34457
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
Crítica
CVE-2023-31543
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Crítica
ghsa-hj8m-9fhf-v7jp
fief-server Server-Side Template Injection vulnerability
Alta
CVE-2023-35005
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.
Alta
CVE-2023-34233
Snowflake Python Connector vulnerable to Command Injection
Media
CVE-2023-32683
Synapse has URL deny list bypass via oEmbed and image URLs when generating previews
Media
CVE-2023-32681
Unintended leak of Proxy-Authorization header in requests
Media
CVE-2023-32323
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites
Alta
CVE-2022-39374
Synapse Denial of service due to incorrect application of event authorization rules during state resolution
Alta
CVE-2022-39335
Synapse does not apply enough checks to servers requesting auth events of events in a room
Crítica
CVE-2023-33175
toui allows user-specific variables to be shared between users
Alta
CVE-2023-30172
A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
Crítica
ghsa-83fm-w79m-64r5
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
Alta
CVE-2023-30620
mindsdb arbitrary file write when extracting a remotely retrieved Tarball
Media
CVE-2022-23522
Arbitrary file write in mindsdb when Extracting Tarballs retrieved from a remote location
Alta
ghsa-cpmr-mw4j-99r7
Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/
Alta
CVE-2023-27586
CairoSVG improperly processes SVG files loaded from external resources
Media
CVE-2023-27494
Streamlit publishes previously-patched Cross-site Scripting vulnerability
Alta
CVE-2023-25617
SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling
Alta
CVE-2023-27522
Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling
Alta
CVE-2023-26043
GeoServer style upload functionality vulnerable to XML External Entity (XXE) injection
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.