Wysoka
CVE-2023-47117
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 1 336
Wyczyść filtry
Średnia
CVE-2023-47037
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.
Średnia
CVE-2023-46136
Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Średnia
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
Wysoka
CVE-2023-45815
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Średnia
CVE-2023-45803
urllib3's request body not stripped after redirect from 303 status changes request method to GET
Średnia
CVE-2023-28635
Defining resource name as integer may give unintended access in vantage6
Krytyczna
ghsa-4mqg-h5jf-j9m7
TorchServe Pre-Auth Remote Code Execution
Krytyczna
CVE-2023-26145
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to targ
Średnia
CVE-2023-41048
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit
Wysoka
CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
Krytyczna
CVE-2019-19450
ReportLab vulnerable to remote code execution via paraparser
Wysoka
CVE-2023-42443
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Średnia
CVE-2023-41885
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Średnia
CVE-2023-40611
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could hav
Średnia
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unrespons
Średnia
CVE-2023-40170
cross-site inclusion (XSSI) of files in jupyter-server
Średnia
CVE-2023-39968
Open Redirect Vulnerability in jupyter-server
Wysoka
CVE-2023-38201
Keylime registrar and (untrusted) Agent can be bypassed by an attacker
Wysoka
CVE-2023-40273
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the s
Krytyczna
CVE-2023-38686
Sydent does not verify email server certificates
Wysoka
CVE-2023-34457
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
Wysoka
CVE-2023-36814
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Średnia
CVE-2023-29159
Starlette has Path Traversal vulnerability in StaticFiles
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.