Medium
ghsa-hfmc-7525-mj55
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,319
Reset filters
Critical
CVE-2023-6569
External Control of File Name or Path in h2oai/h2o-3
High
ghsa-7vwr-g6pm-9hc8
Cookie leakage between different users in fastapi-proxy-lib
Critical
ghsa-x563-6hqv-26mr
Ibis PyArrow dependency allows arbitrary code execution when loading a malicious data file
Medium
CVE-2023-47627
AIOHTTP has problems in HTTP parser (the python one, not llhttp)
High
CVE-2023-46446
AsyncSSH Rogue Session Attack
Medium
CVE-2023-46445
AsyncSSH Rogue Extension Negotiation
High
CVE-2023-47117
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
Medium
CVE-2023-47037
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.
Medium
CVE-2023-46136
Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Medium
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
High
CVE-2023-45815
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Medium
CVE-2023-45803
urllib3's request body not stripped after redirect from 303 status changes request method to GET
Medium
CVE-2023-28635
Defining resource name as integer may give unintended access in vantage6
Critical
ghsa-4mqg-h5jf-j9m7
TorchServe Pre-Auth Remote Code Execution
Critical
CVE-2023-26145
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to targ
Medium
CVE-2023-41048
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit
High
CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
Critical
CVE-2019-19450
ReportLab vulnerable to remote code execution via paraparser
High
CVE-2023-42443
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Medium
CVE-2023-41885
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Medium
CVE-2023-40611
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could hav
Medium
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unrespons
Medium
CVE-2023-40170
cross-site inclusion (XSSI) of files in jupyter-server
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.