Security
Headlines
HeadlinesLatestCVEs

Tag

#git

GHSA-9jvx-p6mq-fw4v: pretix allows Pillow to parse EPS files

pretix before 2023.7.2 allows Pillow to parse EPS files.

ghsa
#git
CVE-2023-26146: Snyk Vulnerability Database | Snyk

All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a malicious payload is served by the application, the filename is displayed without proper sanitization when it is rendered.

CVE-2023-44464: Tags · pretix/pretix

pretix before 2023.7.2 allows Pillow to parse EPS files.

GHSA-86c6-3g63-5w64: Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

CVE-2023-43654: Release TorchServe v0.8.2 Release Notes · pytorch/serve

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity of the system and sensitive data. This issue is present in versions 0.1.0 to 0.8.1. A user is able to load the model of their choice from any URL that they would like to use. The user of TorchServe is responsible for configuring both the allowed_urls and specifying the model URL to be used. A pull request to warn the user when the default value for allowed_urls is used has been merged in PR #2534. TorchServe release 0.8.2 includes this change. Users are advised to upgrade. There are no known workarounds for this issue.

Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack

By Waqas Is it really necessary to display advertisements within an AI chatbot? This is a post from HackRead.com Read the original post: Malicious Ads Infiltrate Bing AI Chatbot in Malvertising Attack

CVE-2023-43662: GHSL-2023-191: Arbitrary File Read

ShokoServer is a media server which specializes in organizing anime. In affected versions the `/api/Image/WithPath` endpoint is accessible without authentication and is supposed to return default server images. The endpoint accepts the parameter `serverImagePath`, which is not sanitized in any way before being passed to `System.IO.File.OpenRead`, which results in an arbitrary file read. This issue may lead to an arbitrary file read which is exacerbated in the windows installer which installs the ShokoServer as administrator. Any unauthenticated attacker may be able to access sensitive information and read files stored on the server. The `/api/Image/WithPath` endpoint has been removed in commit `6c57ba0f0` which will be included in subsequent releases. Users should limit access to the `/api/Image/WithPath` endpoint or manually patch their installations until a patched release is made. This issue was discovered by the GitHub Security lab and is also indexed as GHSL-2023-191.

GHSA-m95q-7qp3-xv42: Zod denial of service vulnerability

Zod version 3.22.2 allows an attacker to perform a denial of service while validating emails.

CVE-2023-4316: zod

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails