CVE Vulnerability Catalog

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can still be replayed and used, allowing an attacker holding a previously valid session cookie to continue accessing protected resources after the configured idle timeout.

NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pickle.load() without validation. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe parameters. A successful exploit of this vulnerability may lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

SQL injection vulnerability in NVIDIA Infrastructure Controller for Linux. An attacker could exploit it to achieve code execution, data tampering, denial of service, and information disclosure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause improper enforcement of a behavioral workflow. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause external control of a file name or path. Successful exploitation might lead to code execution, privilege escalation, data tampering, and denial of service.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause an XML injection. Successful exploitation might lead to data tampering and denial of service.

Improper authentication in NVIDIA Infrastructure Controller for Linux. Could lead to privilege escalation, information disclosure, and data tampering.

Improper certificate validation in NVIDIA Infrastructure Controller for Linux. Could lead to information disclosure, data tampering, and denial of service.

A vulnerability in NVIDIA Infrastructure Controller for Linux involves the use of a hard-coded password. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation may lead to denial of service.

Missing authentication for a critical function in NVIDIA Infrastructure Controller for Linux. Could lead to data tampering, denial of service, and information disclosure.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation might lead to denial of service.

Code injection vulnerability in NVIDIA NeMo Speech. Malicious input could lead to code execution, information disclosure, and data tampering.