Unrated
pysec-2024-1
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,999
Reset filters
High
CVE-2023-51449
Gradio makes the `/file` secure against file traversal and server-side request forgery attacks
Medium
CVE-2023-47265
Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description field of the DAG. Thi
High
CVE-2023-6976
MLflow Path Traversal Vulnerability
High
CVE-2023-6977
MLflow Local File Disclosure Vulnerability
Critical
CVE-2023-6974
MLflow Server-Side Request Forgery (SSRF)
Medium
ghsa-4h72-34j6-j8x7
Maloja error page XSS vulnerability
Medium
ghsa-hfmc-7525-mj55
AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC
Critical
CVE-2023-6569
External Control of File Name or Path in h2oai/h2o-3
High
ghsa-6x4h-9622-fqr6
Improper validation in meraki
Medium
CVE-2023-49795
Server-Side Request Forgery in mindsdb
Low
ghsa-j4g3-3q8x-jxqp
dbt-core's secret env vars written to package-lock.json in plaintext
Medium
CVE-2023-6568
A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malici
Medium
CVE-2023-49080
jupyter-server errors include tracebacks with path information
High
ghsa-7vwr-g6pm-9hc8
Cookie leakage between different users in fastapi-proxy-lib
Medium
ghsa-rqr8-pxh7-cq3g
Ethereum ABI decoder DoS when parsing ZST
Critical
CVE-2023-37924
Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login.
Critical
CVE-2023-46302
Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-1471 .
Critical
CVE-2023-6015
MLflow allowed arbitrary files to be PUT onto the server
Critical
CVE-2023-6018
Remote Code Execution due to Full Controled File Write in mlflow
High
CVE-2023-48054
Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
High
CVE-2023-48052
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
High
CVE-2023-47631
vantage6-server node accepts non-whitelisted algorithms from malicious server
Medium
CVE-2023-47627
AIOHTTP has problems in HTTP parser (the python one, not llhttp)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.