Security advisories

low2024-10-10

Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list

gradio-app/gradio · GHSA-26jh-r8g2-6fpr

medium2024-10-10

CVE-2024-47872-Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files

gradio-app/gradio · GHSA-gvv6-33j7-884g

high2024-10-10

CVE-2024-47871-Gradio uses insecure communication between the FRP client and server

gradio-app/gradio · GHSA-279j-x4gx-hfrh

high2024-10-10

CVE-2024-47870-Gradio has a race condition in update_root_in_config may redirect user traffic

gradio-app/gradio · GHSA-xh2x-3mrm-fwqm

medium2024-10-10

CVE-2024-47869-Gradio performs a non-constant-time comparison when comparing hashes

gradio-app/gradio · GHSA-j757-pf57-f8r4

medium2024-10-10

CVE-2024-47868-Gradio has several components with post-process steps allow arbitrary file leaks

gradio-app/gradio · GHSA-4q3c-cj7g-jcwf

high2024-10-10

CVE-2024-47867-Gradio lacks integrity checking on the downloaded FRP client

gradio-app/gradio · GHSA-8c87-gvhj-xm8m

low2024-10-10

CVE-2024-47168-In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring

gradio-app/gradio · GHSA-hm3c-93pg-4cxw

medium2024-10-10

CVE-2024-47167-Gradio vulnerable to SSRF in the path parameter of /queue/join

gradio-app/gradio · GHSA-576c-3j53-r9jj

medium2024-10-10

CVE-2024-47166-Gradio has a one-level read path traversal in `/custom_component`

gradio-app/gradio · GHSA-37qc-qgx6-9xjv

medium2024-10-10

CVE-2024-47165-Gradio's CORS origin validation accepts the null origin

gradio-app/gradio · GHSA-89v2-pqfv-c5r9

high2024-10-10

CVE-2024-9180-Vault Community Edition privilege escalation vulnerability

hashicorp/vault · GHSA-rr8j-7w34-xp5j

medium2024-10-10

CVE-2024-47164-Gradio's `is_in_or_equal` function may be bypassed

gradio-app/gradio · GHSA-77xq-6g77-h274

high2024-10-10

CVE-2024-47084-Gradios's CORS origin validation is not performed when the request has a cookie

gradio-app/gradio · GHSA-3c67-5hwx-f6wx

medium2024-10-10

CVE-2024-47067-Alist reflected Cross-Site Scripting vulnerability

alist-org/alist · GHSA-8pph-gfhp-w226

medium2024-10-10

CVE-2024-9312-Authd allows attacker-controlled usernames to yield controllable UIDs

ubuntu/authd · GHSA-4gfw-wf7c-w6g2

high2024-10-10

CVE-2024-38365-btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality

btcsuite/btcd · GHSA-27vh-h6mc-q6g8

medium2024-10-10

CVE-2024-45131-Magento Open Source Improper Authorization vulnerability

magento/magento2 · GHSA-xc5p-773w-m3pm

low2024-10-10

CVE-2024-45149-Magento Open Source Improper Access Control vulnerability

magento/magento2 · GHSA-w7rg-7wq2-pjrw

medium2024-10-10

CVE-2024-45133-Magento Open Source Information Exposure vulnerability

magento/magento2 · GHSA-j3mh-wx5f-2vhg