#web

### 1. Impacted Products Streamilt Open Source versions before 1.37.0. ### 2. Introduction Snowflake Streamlit open source addressed a security vulnerability via the [static file sharing feature](https://docs.streamlit.io/develop/concepts/configuration/serving-static-files). The vulnerability was patched on Jul 25, 2024, as part of Streamlit open source version 1.37.0. The vulnerability only affects Windows. ### 3. Path Traversal Vulnerability #### 3.1 Description On May 12, 2024, Streamlit was informed via our bug bounty program about a path traversal vulnerability in the open source library. We fixed and merged a patch remediating the vulnerability on Jul 25, 2024. The issue was determined to be in the moderate severity range with a maximum CVSSv3 base score of [5.9](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N) #### 3.2 Scenarios and attack vector(s) Users of hosted Streamlit app(s) on Windows were vulnerable to a path traversal vulnerabi...

Gentoo Linux Security Advisory 202408-33 - Multiple vulnerabilities have been discovered in protobuf-c, the worst of which could result in denial of service. Versions greater than or equal to 1.4.1 are affected.

Gentoo Linux Security Advisory 202408-32 - Multiple vulnerabilities have been discovered in PHP, the worst of which can lead to a denial of service. Versions greater than or equal to 8.1.29:8.1 are affected.

Gentoo Linux Security Advisory 202408-31 - A vulnerability has been discovered in protobuf and protobuf-python, which can lead to a denial of service. Versions greater than or equal to 3.20.3 are affected.

Gentoo Linux Security Advisory 202408-30 - A vulnerability has been discovered in dpkg, which allows for directory traversal. Versions greater than or equal to 1.20.9-r1 are affected.

Gentoo Linux Security Advisory 202408-29 - Multiple vulnerabilities have been discovered in MuPDF, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.20.0 are affected.

Gentoo Linux Security Advisory 202408-28 - A vulnerability has been discovered in rsyslog, which could possibly lead to remote code execution. Versions greater than or equal to 8.2206.0 are affected.

Gentoo Linux Security Advisory 202408-27 - A vulnerability has been discovered in AFLplusplus, which can lead to arbitrary code execution via an untrusted CWD. Versions greater than or equal to 4.06c are affected.

Computer Laboratory Management version 1.0 suffers from a remote authenticated SQL injection vulnerability.

Gentoo Linux Security Advisory 202408-26 - Multiple vulnerabilities have been discovered in matio, the worst of which could lead to arbitrary code execution. Versions greater than or equal to 1.5.22 are affected.