Search CVE reports
181 – 190 of 44358 results
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers....
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 20.04 LTS |
|---|---|
| freerdp | — |
| freerdp2 | Needs evaluation |
| freerdp3 | — |
FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) calls...
3 affected packages
freerdp, freerdp2, freerdp3
| Package | 20.04 LTS |
|---|---|
| freerdp | — |
| freerdp2 | Needs evaluation |
| freerdp3 | — |
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the...
1 affected package
keras
| Package | 20.04 LTS |
|---|---|
| keras | Needs evaluation |
GitPython before 3.1.50 fails to validate newline characters in the section parameter of config_writer(), allowing attackers to inject arbitrary section headers into .git/config. Attackers can inject newlines to create a forged...
1 affected package
python-git
| Package | 20.04 LTS |
|---|---|
| python-git | Needs evaluation |
GitPython before 3.1.51 contains an incomplete command injection blocklist that fails to account for git's long-option prefix abbreviation feature. Attackers can bypass the unsafe options guard by using abbreviated option names...
1 affected package
python-git
| Package | 20.04 LTS |
|---|---|
| python-git | Needs evaluation |
GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options...
1 affected package
python-git
| Package | 20.04 LTS |
|---|---|
| python-git | Needs evaluation |
GitPython before 3.1.51 fails to guard against dangerous Git options passed as keyword arguments in Repo.archive() and git.ls_remote(), allowing command injection via options such as --exec/--upload-pack (leading to arbitrary...
1 affected package
python-git
| Package | 20.04 LTS |
|---|---|
| python-git | Needs evaluation |
GitPython before 3.1.52 is vulnerable to environment-variable exfiltration in Repo.clone_from(). The caller-supplied remote URL is passed through Git.polish_url(), which on non-Cygwin platforms calls os.path.expandvars() on the...
1 affected package
python-git
| Package | 20.04 LTS |
|---|---|
| python-git | Needs evaluation |
axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFormData.js when serializing objects with top-level keys ending in '{}'. Attackers who control object keys and nested...
1 affected package
node-axios
| Package | 20.04 LTS |
|---|---|
| node-axios | Needs evaluation |
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the...
1 affected package
node-axios
| Package | 20.04 LTS |
|---|---|
| node-axios | Needs evaluation |