Summary The IBM® Engineering System Design Rhapsody 10.0 iFix001, The IBM® Engineering System Design Rhapsody 9.0.2 iFix002 and The IBM® Engineering System Design Rhapsody 9.0.1 iFix006 contain fixes for vulnerabilities identified in the Vulnerabilities Details section. The refererred iFix...
5.3CVSS
8AI Score
0.033EPSS
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-flask-cors,...
5.3CVSS
6AI Score
0.0004EPSS
7.5AI Score
9.8CVSS
9.7AI Score
0.002EPSS
CVE-2023-45803 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-tensorflow-serving-api, jwt-tool, py3-urllib3,...
4.2CVSS
7.1AI Score
0.0004EPSS
GHSA-84PR-M4JR-85G5 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-flask-cors,...
7.5AI Score
CVE-2024-34064 vulnerabilities
Vulnerabilities for packages: pytorch, kubeflow-jupyter-web-app, superset, py3-jinja2, confluent-docker-utils, dask-gateway, kubeflow-volumes-web-app,...
5.4CVSS
6.1AI Score
0.0004EPSS
GHSA-G4MX-Q9VG-27P4 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-tensorflow-serving-api, jwt-tool, py3-urllib3,...
7.5AI Score
CVE-2023-46136 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-werkzeug, airflow, py3-tensorflow-serving-api,...
8CVSS
7.9AI Score
0.001EPSS
GHSA-HRFV-MQP8-Q5RW vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, py3-werkzeug, airflow, py3-tensorflow-serving-api,...
7.5AI Score
GHSA-2G68-C3QC-8985 vulnerabilities
Vulnerabilities for packages: py3.10-tensorflow-core, kubeflow-jupyter-web-app, py3-werkzeug, superset,...
7.5AI Score
CVE-2024-34069 vulnerabilities
Vulnerabilities for packages: py3.10-tensorflow-core, kubeflow-jupyter-web-app, py3-werkzeug, superset,...
7.5CVSS
7.7AI Score
0.0004EPSS
GHSA-H75V-3VVJ-5MFJ vulnerabilities
Vulnerabilities for packages: pytorch, kubeflow-jupyter-web-app, superset, py3-jinja2, confluent-docker-utils, dask-gateway, kubeflow-volumes-web-app,...
7.5AI Score
SonarQube logs sensitive information
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs,...
4.9CVSS
6.9AI Score
0.0004EPSS
CVE-2023-43804 vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, kube-downscaler, py3-urllib3, k8s-sidecar, dask-gateway,...
8.1CVSS
7.7AI Score
0.001EPSS
GHSA-V845-JXX5-VC9F vulnerabilities
Vulnerabilities for packages: kubeflow-jupyter-web-app, kube-downscaler, py3-urllib3, k8s-sidecar, dask-gateway,...
7.5AI Score
Malicious code in scm-design-system-cra (npm)
-= Per source details. Do not edit below this line.=- Source: ossf-package-analysis (a41692a79d6b73b049dbff75d56c8a18218a4878d024ef4c0da7b19b16ebab3a) The OpenSSF Package Analysis project identified 'scm-design-system-cra' @ 0.1.1 (npm) as malicious. It is considered malicious because: The...
7.1AI Score
Malicious code in nespresso-design-system (npm)
-= Per source details. Do not edit below this line.=- Source: ghsa-malware (e4df4d16cd100a965fef42c58150e9688849a5acfa8de2f809b3ed66f5ef9f29) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
7AI Score
CVE-2024-37891 vulnerabilities
Vulnerabilities for packages: ggshield, az, kubeflow-jupyter-web-app, superset, kubeflow-katib, airflow, kubeflow-pipelines, mlflow, py3-urllib3, confluent-docker-utils, k8s-sidecar, dask-gateway, py3-cassandra-medusa, kubeflow-volumes-web-app,...
4.4CVSS
4.9AI Score
0.0004EPSS
GHSA-9WX4-H78V-VM56 vulnerabilities
Vulnerabilities for packages: py3.10-tensorflow-core, ggshield, az, jwt-tool, kubeflow-jupyter-web-app, superset, kubeflow-katib, datadog-agent, airflow, kubeflow-pipelines, patroni, mlflow, confluent-docker-utils, k8s-sidecar, py3-cassandra-medusa, kubeflow-volumes-web-app,...
7.5AI Score
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL...
8.1CVSS
7.9AI Score
0.0004EPSS
Spring Framework URL Parsing with Host Validation Vulnerability
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...
8.1CVSS
7AI Score
0.0004EPSS
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation...
8.1CVSS
6.7AI Score
0.0004EPSS
GHSA-34JH-P97F-MPXF vulnerabilities
Vulnerabilities for packages: ggshield, az, kubeflow-jupyter-web-app, superset, kubeflow-katib, airflow, kubeflow-pipelines, mlflow, py3-urllib3, confluent-docker-utils, k8s-sidecar, dask-gateway, py3-cassandra-medusa, kubeflow-volumes-web-app,...
7.5AI Score
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.10-tensorflow-core, py3-idna, ggshield, az, jwt-tool, kubeflow-jupyter-web-app, kubeflow-katib, datadog-agent, kubeflow-pipelines, confluent-docker-utils, k8s-sidecar, dask-gateway, py3-cassandra-medusa,...
6.7AI Score
EPSS
GHSA-JJG7-2V4V-X38H vulnerabilities
Vulnerabilities for packages: kubeflow-pipelines-visualization-server, py3.10-tensorflow-core, py3-idna, ggshield, az, jwt-tool, kubeflow-jupyter-web-app, kubeflow-katib, datadog-agent, kubeflow-pipelines, confluent-docker-utils, k8s-sidecar, dask-gateway, py3-cassandra-medusa,...
7.5AI Score
CVE-2024-35195 vulnerabilities
Vulnerabilities for packages: py3.10-tensorflow-core, ggshield, az, jwt-tool, kubeflow-jupyter-web-app, superset, kubeflow-katib, datadog-agent, airflow, kubeflow-pipelines, patroni, mlflow, confluent-docker-utils, k8s-sidecar, py3-cassandra-medusa, kubeflow-volumes-web-app,...
5.6CVSS
6.1AI Score
0.0004EPSS
org.springframework: spring-web is vulnerable Open Redirect. The vulnerability is caused due to improper validation checks on the host of the parsed URL, which could lead to potential SSRF attacks if the URL is utilized...
8.1CVSS
7AI Score
0.0004EPSS
Server Side Request Forgery (SSRF)
org.springframework:spring-web is vulnerable to Open Redirect. The vulnerability is due to insufficient validation checks of the host URL within UriComponentsBuilder.java. If an application utilizes the host validation checks, an attacker can perform an open redirect or Server-Side Request Forgery....
8.1CVSS
6.7AI Score
0.0004EPSS
Server Side Request Forgery (SSRF)
org.springframework:spring-web is vulnerable to Open Redirect. The vulnerability is due to insufficient validation checks of the host URL within UriComponentsBuilder.java. If an application utilizes the host validation checks, an attacker can perform an open redirect or Server-Side Request Forgery....
8.1CVSS
8AI Score
0.0004EPSS
Spring Web vulnerable to Open Redirect or Server Side Request Forgery
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect attack or to a SSRF attack if the URL is used after passing validation...
8.1CVSS
7AI Score
0.0004EPSS
Spring Framework URL Parsing with Host Validation
Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL...
8.1CVSS
6.5AI Score
0.0004EPSS
Spring Framework URL Parsing with Host Validation Vulnerability
Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF...
8.1CVSS
7AI Score
0.0004EPSS
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized...
9.8CVSS
7.7AI Score
0.002EPSS
It was discovered that the IcedTea-Web used codebase attribute of the tag on the HTML page that hosts Java applet in the Same Origin Policy (SOP) checks. As the specified codebase does not have to match the applet's actual origin, this allowed malicious site to bypass SOP via spoofed codebase...
7.5CVSS
6.4AI Score
0.002EPSS
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'ajax' parameter in...
6.1CVSS
6.1AI Score
0.001EPSS
OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick an authenticated user into performing any kind of state changing...
8.8CVSS
6.8AI Score
0.001EPSS
Multiple vulnerabilities in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager; Secure Email Gateway, formerly Email Security Appliance (ESA); and Secure Web Appliance could allow a remote attacker to conduct a cross-site scripting (XSS) attack...
5.9AI Score
0.0004EPSS
A vulnerability, which was classified as problematic, was found in Acumos Design Studio up to 2.0.7. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 2.0.8 is able to address this issue. The name of.....
6.1CVSS
6.3AI Score
0.001EPSS
Web Sockets do not execute any AuthenticateMethod methods which may be set, leading to a nil pointer dereference if the returned UserData pointer is assumed to be non-nil, or authentication bypass. This issue only affects WebSockets with an AuthenticateMethod hook. Request handlers that do not...
9.8CVSS
9.7AI Score
0.002EPSS
The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin generates a database backup, the backup is stored in the web root while the file name has a format of "opensisBackup.sql" (e.g....
9.8CVSS
7AI Score
0.001EPSS
The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'filename' parameter of...
7.5CVSS
7AI Score
0.001EPSS
An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to access any student's files by visiting...
7.5CVSS
7.1AI Score
0.001EPSS
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into any of the 'calendar_id', 'school_date', 'month' or...
6.1CVSS
6.1AI Score
0.001EPSS
A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'include' parameter in...
6.1CVSS
6.1AI Score
0.001EPSS
Vert.x-Web is a set of building blocks for building web applications in the java programming language. When running vertx web applications that serve files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (*) then an attacker can...
5.3CVSS
5.9AI Score
0.001EPSS
jellyfin-web is the web client for Jellyfin, a free-software media system. Starting in version 10.1.0 and prior to version 10.8.10, a stored cross-site scripting vulnerability in device.js can be used to make arbitrary calls to the REST endpoints with admin privileges. When combined with...
9CVSS
8.1AI Score
0.001EPSS
Symfony Cross-Site Request Forgery vulnerability in the Web Profiler
All 2.0.X, 2.1.X, 2.2.X, 2.3.X, 2.4.X, and 2.5.X versions of the Symfony WebProfiler bundle are affected by this security issue. This issue has been fixed in Symfony 2.3.19, 2.4.9, and 2.5.4. Note that no fixes are provided for Symfony 2.0, 2.1, and 2.2 as they are not maintained anymore....
7.4AI Score
EPSS
SonarQube logs sensitive information
In SonarQube before 10.4 and 9.9.4 LTA, encrypted values generated using the Settings Encryption feature are potentially exposed in cleartext as part of the URL parameters in the logs (such as SonarQube Access Logs, Proxy Logs,...
4.9CVSS
6.9AI Score
0.0004EPSS
This auxiliary module is a modular web crawler, to be used in conjunction with wmap (someday) or...
7.3AI Score