Vulnerabilidades

Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component. The KVStore server, used for distributed task coordination, lacks authentication and authorization controls, allowing any remote attacker to write arbitrary data via HTTP PUT requests. When a Horovod…

Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability. The specific flaw exists within the add_tool endpoint,…

dpic 2021.04.10 has a use-after-free in thedeletestringbox() function in dpic.y. A different vulnerablility than CVE-2021-32421.

dpic 2021.04.10 has a Heap Buffer Overflow in themakevar() function in dpic.y

dpic 2021.01.01 has a Global buffer overflow in theyylex() function in main.c and reads out of the bound array.

dpic 2021.01.01 has a Heap Use-After-Free in thedeletestringbox() function in dpic.y.

dpic 2021.01.01 has a Heap-based Buffer Overflow in thestorestring function in dpic.y.

dpic 2019.06.20 has a Stack-based Buffer Overflow in the wfloat() function in main.c.

Multiple PHP remote file inclusion vulnerabilities in KDPics 1.16 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the (1) page parameter to (a) index.php3, or the (2) lib_path parameter to (b) authenticate.inc.php3 or (c) lib/exifer/exif.php.

Multiple cross-site scripting (XSS) vulnerabilities in KDPics 1.16 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) categories parameter to (a) index.php3 or (b) galeries.inc.php3.