CVE Vulnerability Catalog

A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).

A deserialization of untrusted data vulnerability in the load_dataset_cache_file function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the parse_model function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute Python code. User interaction is required (visiting a malicious page or opening a malicious file).

A command injection vulnerability in the torch_safe_load function of Ultralytics could lead to remote code execution. The flaw results from lack of proper validation of a user-supplied string before using it to execute a system call. User interaction is required (visiting a malicious page or opening a malicious file).

A code injection vulnerability in the check_det_dataset function of Ultralytics allows remote code execution. The flaw stems from lack of validation of a user-supplied string before using it to execute Python code. User interaction is required — the target must visit a malicious page or open a malicious file.

A deserialization of untrusted data vulnerability in the torch_load function of Ultralytics allows remote code execution. The flaw results from lack of validation of user-supplied data. User interaction is required — the target must visit a malicious page or open a malicious file.

A stack-based buffer overflow in the Android Auto service of Alpine iLX-F511 devices allows remote code execution. The flaw results from lack of validation of user-supplied data length before copying it to a fixed-length stack buffer. A network-adjacent attacker can exploit it without authentication.

An exposed dangerous function in the framework service of Alpine iLX-F511 devices allows remote code execution. A network-adjacent attacker can exploit it without authentication. Code executes with root privileges.

A stack-based buffer overflow in the prh_sdp_service_search_decode function of Alpine iLX-F511 devices allows remote code execution. The flaw results from lack of validation of user-supplied data length before copying it to a stack buffer. The attacker must first pair a malicious Bluetooth device with the target.

A stack-based buffer overflow in vCard parsing on Alpine iLX-F511 devices allows remote code execution. The flaw results from lack of validation of user-supplied data before copying it to a fixed-length stack buffer. User interaction is required — the target must connect to a malicious Bluetooth device.

An exposed dangerous method in the Fiv service of Alpine iLX-F511 devices allows local privilege escalation. The attacker must first obtain the ability to execute low-privileged code. Exploitation allows executing code as root.

A type-handling flaw in relationship query building of the MongoDB integration library causes a check for the absence of a related record to be compiled with an identifier of the wrong data type. In applications relying on this check, a user with basic privileges may be served, change, or remove documents the check was meant to withhold. The failure is silent and produces no error.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing objects of types marked as storing their configuration in independent top-level configuration files as nested values. This allows attackers to bypass the root element check and potentially inject nested objects.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in the "Manage Old Data" feature that can be acted on by administrators to inject attacker-controlled data, overriding existing user account information, including login passwords.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication, including with an API token, to obtain a "remember me" cookie, allowing attackers who have obtained a user's API token to retain access to Jenkins using a "remember me" cookie after the API token is revoked or expires.

In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not check whether the setup wizard has been completed, resulting in a race condition that allows unauthenticated attackers to create an administrator account while the initial user account is being replaced.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only before creating its parent directories, not immediately before writing it, and allows symbolic links in artifacts to replace existing files or empty directories, allowing attackers with Item/Configure permission to write files to arbitrary locations on the Jenkins controller file system.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without validating the name, allowing attackers with Overall/Read permission to load any config.xml file on the controller file system as an agent configuration, and to overwrite an arbitrary config.xml file when that agent is saved, potentially resulting in arbitrary code execution.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into launchers provided by the Command Agent Launcher Plugin without checking whether they have been approved by an administrator, allowing attackers with Agent/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by the `resolves-to` attribute during XStream deserialization. This may allow bypassing the filter and deserializing dangerous classes.