CVE

A command injection exists in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication.

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using the Prefect API.

An attacker is able to read any file on the server hosting the H2O dashboard without any authentication.

H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.

H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL.

LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication.

An attacker can overwrite any file on the server hosting MLflow without any authentication.

An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature.

An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter.

Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.