Wysoka
CVE-2024-29190
Archiwum podatności
Poznaj podatności. Chroń swoje aplikacje.
Dowiedz się, które luki zagrażają Twoim technologiom i jak je usunąć. Znajdziesz tu opisy zagrożeń, podatne wersje i konkretne zalecenia - od CMS-ów i wtyczek po biblioteki aplikacji.
Archiwum podatności 6 855
Wyczyść filtry
Niska
ghsa-cq96-9974-v8hm
Dynamic Variable Evaluation in qiskit-ibm-runtime
Krytyczna
CVE-2024-28179
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
Średnia
CVE-2024-21503
Black vulnerable to Regular Expression Denial of Service (ReDoS)
Średnia
CVE-2024-28237
XSS via the "Snapshot Test" feature in Classic Webcam plugin settings
Średnia
CVE-2024-27351
Regular expression denial-of-service in Django
Niska
ghsa-879p-8gw4-mcpw
fgr Vulnerable to Insecure Default Variable Initialization
Krytyczna
CVE-2024-22203
Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
Krytyczna
CVE-2024-22205
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` met
Średnia
CVE-2024-22204
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The `config` function in `app
Średnia
CVE-2024-22417
Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and
Wysoka
CVE-2024-28425
greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py. This vulnerability allows attackers to execute arbitrary code v
Średnia
CVE-2024-23823
vantage6's CORS settings overly permissive
Średnia
CVE-2024-28746
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which t
Średnia
CVE-2024-27305
aiosmtpd vulnerable to SMTP smuggling
Wysoka
CVE-2024-27758
RPyC's missing security check results in code execution when using numpy.array on the server-side.
Krytyczna
CVE-2024-2044
pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user
Średnia
ghsa-3qwc-47jf-5rf7
eth-abi is vulnerable to recursive DoS
Niska
CVE-2024-28088
LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading con
Średnia
CVE-2024-26280
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permit
Krytyczna
CVE-2024-2057
A vulnerability was found in LangChain langchain_community 0.0.26. It has been classified as critical. Affected is the function load_local in the library libs/community/langchain_community/retrievers/
Średnia
CVE-2024-27906
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI.
Średnia
CVE-2024-24779
Apache Superset: Improper data authorization when creating a new dataset
Średnia
CVE-2024-26016
Apache Superset: Improper authorization validation on dashboards and charts import
Dowiedz się, które podatności dotyczą Twojej aplikacji
Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.