Unrated
pysec-2024-1
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,359
Reset filters
Medium
CVE-2023-51663
Hail relies on OIDC email claims to verify the validity of a user's domain.
High
CVE-2023-51449
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
Low
CVE-2023-51649
Nautobot missing object-level permissions enforcement when running Job Buttons
Medium
CVE-2023-50783
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.
Medium
CVE-2023-49920
Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for a malicious website
Medium
CVE-2023-47265
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. Thi
Medium
CVE-2023-48291
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write acce
High
ghsa-9wgg-m99q-hhfc
Expired tokens can be renewed without validating the account password
High
CVE-2023-6940
mlflow Command Injection vulnerability
Medium
ghsa-4h72-34j6-j8x7
Maloja error page XSS vulnerability
Medium
ghsa-hfmc-7525-mj55
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
Critical
CVE-2023-6569
External Control of File Name or Path in h2oai/h2o-3
Critical
CVE-2023-6572
Gradio Exposure of Sensitive Information to an Unauthorized Actor vulnerability
High
CVE-2023-46247
incorrect storage layout for contracts containing large arrays
High
ghsa-6x4h-9622-fqr6
Improper validation in meraki
Low
CVE-2023-50263
Unauthenticated db-file-storage views
Critical
CVE-2023-43364
Searchor CLI's Search vulnerable to Arbitrary Code using Eval
Critical
CVE-2023-50423
Improper Privilege Management in sap-xssec
High
CVE-2023-49797
Local Privilege Escalation in Windows
Low
ghsa-j4g3-3q8x-jxqp
dbt-core's secret env vars written to package-lock.json in plaintext
Low
CVE-2023-49297
PyDrive2's unsafe YAML deserialization in LoadSettingsFile allows arbitrary code execution
High
CVE-2023-43472
Information exposure in MLflow
Medium
CVE-2023-49081
aiohttp's ClientSession is vulnerable to CRLF injection via version
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.