Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5,597

CVE-2024-47870

Race condition in update_root_in_config may redirect user traffic in Gradio

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves a **race condition** in the `update_root_in_config` function, allowing an attacker to modify the `root` URL used by the Gradio frontend to communicate with the backend. By exploiting this flaw, an attacker can redirect user traffic to a malicious server. This could lead to the interception of sensitive data such as authentication credentials or uploaded files. This impacts all users who connect to a Gradio server, especially those exposed to the internet, where malicious actors could exploit this race condition. Users are advised to upgrade to `gradio>=5` to address this issue. There are no known workarounds for this issue.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gradio Project
Products
Gradio
CVE-2024-45290

Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from external URLs. When opening the XLSX file, PhpSpreadsheet retrieves the image size and type by reading the file contents, if the provided path is a URL. By using specially crafted `php://filter` URLs an attacker can leak the contents of any file or URL. Note that this vulnerability is different from GHSA-w9xv-qf98-ccq4, and resides in a different component. An attacker can access any file on the server, or leak information form arbitrary URLs, potentially exposing sensitive information such as AWS IAM credentials. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Phpoffice
Products
Phpspreadsheet
CVE-2024-45291

Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from arbitrary paths. When embedding images has been enabled in HTML writer with `$writer->setEmbedImages(true);` those files will be included in the output as `data:` URLs, regardless of the file's type. Also URLs can be used for embedding, resulting in a Server-Side Request Forgery vulnerability. When embedding images has been enabled, an attacker can read arbitrary files on the server and perform arbitrary HTTP GET requests. Note that any PHP protocol wrappers can be used, meaning that if for example the `expect://` wrapper is enabled, also remote code execution is possible. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. there are no known workarounds for this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Phpoffice
Products
Phpspreadsheet
CVE-2024-0132

nvidia-container-toolkit: Time-of-check Time-of-use (TOCTOU) Race Condition in NVIDIA Container toolkit

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

CVSS 3.1 · 9 Critical EPSS 40.8% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Container Toolkit Gpu Operator and 2 more
CVE-2024-0133

nvidia-container-toolkit: Data tampering in NVIDIA Container Toolkit

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to data tampering.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Linux Nvidia
Products
Linux Kernel Nvidia Container Toolkit Nvidia Gpu Operator
CVE-2024-46839

kernel: workqueue: Improve scalability of workqueue watchdog touch

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux
CVE-2024-6787

MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition

This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). By exploiting this race condition, an attacker can write arbitrary files to the system. This could allow the attacker to execute malicious code and potentially cause file losses.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Moxa
Products
Mxview One
CVE-2024-45300

Bypassing promo code limitations with race conditions

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, a race condition allows the user to bypass the limit on the number of promo codes and use the discount coupon multiple times. In "alf.io", an event organizer can apply price discounts by using promo codes to your events. The organizer can limit the number of promo codes that will be used for this, but the time-gap between checking the number of codes and restricting the use of the codes allows a threat actor to bypass the promo code limit. Version 2.0-M5 fixes this issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Alf
Products
Alf
CVE-2024-42488

Cilium agent's race condition may lead to policy bypass for Host Firewall policy

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.14.14 and 1.15.8, a race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. This issue has been patched in Cilium v1.14.14 and v1.15.8 As the underlying issue depends on a race condition, users unable to upgrade can restart the Cilium agent on affected nodes until the affected policies are confirmed to be working as expected.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Cilium
Products
Cilium
CVE-2024-8778

The SYSCOM Group OMFLOW - Arbitrary File Read

OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arbitrary system files.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Syscomgo
Products
Omflow
CVE-2024-7627

Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions.

CVSS 3.1 · 8.1 High EPSS 2.8% KEV · Not listed
Vendors
Bitapps
Products
File Manager
CVE-2024-7323

Digiwin EasyFlow .NET - Arbitrary File Download

Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with regular privilege can exploit this vulnerability to download arbitrary files from the remote server .

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Digiwin
Products
Easyflow .net
CVE-2024-7867

Integer overflow and divide-by-zero in Xpdf 4.05 due to bogus page box coordinates

In Xpdf 4.05 (and earlier), very large coordinates in a page box can cause an integer overflow and divide-by-zero.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Xpdfreader
Products
Xpdf
CVE-2024-39425

Security vulnerability in AdobeARMHelper

Acrobat Reader versions 20.005.30636, 24.002.20965, 24.002.20964, 24.001.30123 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to privilege escalation. Exploitation of this issue require local low-privilege access to the affected system and attack complexity is high.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Acrobat Acrobat Dc Acrobat Reader and 3 more
CVE-2024-26905

kernel: btrfs: fix data races when accessing the reserved amount of block reserves

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2024-27430

kernel: netrom: Fix a data-race around sysctl_netrom_default_path_quality

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2024-27428

kernel: netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2024-27427

kernel: netrom: Fix a data-race around sysctl_netrom_transport_timeout

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2024-27426

kernel: netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—