RealworldDataset.csv

CVE,CWE Type,Type,vul position,project,Bearer_reason,DevSkim_reason,Dlint_reason,Bandit_reason,Semgrep_reason,Codeql_reason,Pysa_reason,Project Type,Version
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37274,"94;664,707",code injection,autogpt/commands/execute_code.py:execute_python_file,https://github.com/Significant-Gravitas/AutoGPT,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),complex d/c-f diff (RC3),implicit sink (RC3),complex d/c-f  diff (RC3),complex d/c-f diff (RC3),manage/monitor platform,0.4.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31462,22;664,path traversal,modules/ui_extensions.py:save_config_state,https://github.com/AUTOMATIC1111/stable-diffusion-webui,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,"inadquate capability (RC2), no sink (RC1)",webui,1.7.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3568,502;664,Deserialization,src/transformers/modeling_tf_utils.py:TFPreTrainedModel.load_repo_checkpoint,https://github.com/huggingface/transformers,capability (RC3),detected,detected,no rule (RC1),detected,interface-source (RC1),interface-source (RC1),ai library,-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-7018,502;664,Deserialization,src/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py:TransfoXLTokenizer.__init__; src/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py:TransfoXLCorpus.get_lm_corpus; src/transformers/models/rag/retrieval_rag.py:LegacyIndex._load_passages,https://github.com/huggingface/transformers,detected,detected,detected,detected,detected,interface-source (RC1),"inadquate capability (RC2), interface-source (RC1)",ai library,prior to 4.36
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6730,502;664,Deserialization,src/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py:TransfoXLTokenizer.__init__; src/transformers/models/deprecated/transfo_xl/tokenization_transfo_xl.py:TransfoXLCorpus.get_lm_corpus; src/transformers/models/rag/retrieval_rag.py:LegacyIndex._load_passages,https://github.com/huggingface/transformers,detected,detected,detected,detected,detected,interface-source (RC1),"inadquate capability (RC2), interface-source (RC1)",ai library,prior to 4.36
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34363,22;664,path traversal,thefuck/rules/dirty_untar.py:side_effect; thefuck/rules/dirty_unzip.py:side_effect,https://github.com/nvbn/thefuck,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),complex d/c-f source (RC2),complex d/c-f (RC2),command line tool,before 3.31
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45907,"94;664,707",code injection,torch/jit/annotations.py:parse_type_line,https://github.com/pytorch/pytorch,detected,implementation (RC1),detected,no rule (RC1),detected,interface-source (RC1),"inadquate capability (RC2), interface-source (RC1)",ai library,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22423,78;707,OS Command Injection,yt_dlp/postprocessor/exec.py:ExecPP.run,https://github.com/yt-dlp/yt-dlp,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),detected,no sink (RC1),complex d/c-f source (RC2),"complex d/c-f (RC2), inadquate capability (RC2)",command line tool,yt-dlp version 2024.04.09 fixes this issue
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40581,78;707,OS Command Injection,yt_dlp/postprocessor/exec.py:ExecPP.run,https://github.com/yt-dlp/yt-dlp,detected,no rule (RC1),detected,detected,detected,complex d/c-f source (RC2),"complex d/c-f (RC2), inadquate capability (RC2)",command line tool,yt-dlp version 2023.09.24 fixes this issue
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39330,22;664,path traversal,django/core/files/storage/base.py:Storage.save,https://github.com/django/djangohttps://github.com/django/django,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),interface-source (RC1),interface-source (RC1),web framework,Django 5.0 before 5.0.7 and 4.2 before 4.2.14
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34265,89;707,sql injection,django/db/backends/mysql/operations.py:date_extract_sql; django/db/backends/oracle/operations.py:date_extract_sql; django/db/backends/postgresql/operations.py:date_extract_sql; django/db/backends/sqlite3/operations.py:date_extract_sql,https://github.com/django/djangohttps://github.com/django/django,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),rule implementation (RC1),partial detected (RC3),complex d/c-f source (RC2),complex d/c-f (RC2),web framework,Django 3.2 before 3.2.14 and 4.0 before 4.0.6
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28347,89;707,sql injection,django/db/backends/postgresql/operations.py:explain_query_prefix,https://github.com/django/djangohttps://github.com/django/django,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),complex d/c-f (RC3),partial detected (RC3),complex d/c-f source (RC2),complex d/c-f (RC2),web framework,"Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45452,22;664,path traversal,django/core/files/storage.py:Storage._save,https://github.com/django/djangohttps://github.com/django/django,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),interface-source (RC1),interface-source (RC1),web framework,"Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33203,22;664,path traversal,django/contrib/admindocs/views.py:TemplateDetailView.get_context_data,https://github.com/django/djangohttps://github.com/django/django,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,interface-source (RC1),web framework,"Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41656,79;707,cross-site scripting,src/sentry/integrations/mixins/issues.py:IssueBasicMixin.map_external_issues_to_annotations; src/sentry/models/platformexternalissue.py:PlatformExternalIssue.get_annotations_for_group_list; src/sentry/plugins/bases/issue.py:IssueTrackingPlugin.tags; src/sentry/plugins/bases/issue2.py:IssueTrackingPlugin2.tags,https://github.com/getsentry/sentry,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),complex d/c-f (RC2),manage/monitor platform,Starting in version 10.0.0 and prior to version 24.7.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-26947,79;707,cross-site scripting,addons/auth_signup/controllers/main.py:AuthSignupHome.web_auth_signup; addons/web/controllers/main.py:Home.web_login,https://github.com/odoo/odoo,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),"complex d/c-f (RC2), inadquate capability (RC2)",web apps,Odoo Community 15.0 and Odoo Enterprise 15.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15635,79;707,cross-site scripting,addons/mail/wizard/invite.py:Invite.default_get,https://github.com/odoo/odoo,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),"complex d/c-f (RC2), inadquate capability (RC2)",web apps,"Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15634,79;707,cross-site scripting,addons/web/controllers/main.py:Binary.upload; addons/web/controllers/main.py:Binary.upload_attachment,https://github.com/odoo/odoo,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),partial detected (RC3),complex d/c-f source (RC2),"complex d/c-f (RC2), inadquate capability (RC2)",web apps,Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9416,22;664,path traversal,odoo/tools/misc.py:_fileopen,https://github.com/odoo/odoo,implementation (RC1),no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),complex d/c-f source (RC2),complex d/c-f (RC2),web apps,"Odoo 8.0, 9.0, and 10.0"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10803,502;664,Deserialization,addons/anonymization/wizard/anonymize_wizard.py:IrModelFieldsAnonymizeWizard.anonymize_database,https://github.com/odoo/odoo,detected,no rule (RC1),no rule (RC1),no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f (RC2),web apps,"Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39877,"94;664,707",code injection,airflow/models/dag.py:DAG.get_doc_md,https://github.com/apache/airflow,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),intrinsic (RC2),detected,no sink (RC1),manage/monitor platform,"2.4.0, and versions before 2.9.3"
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39863,79;707,cross-site scripting,airflow/www/views.py:ProviderView._clean_description,https://github.com/apache/airflow,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f (RC2),manage/monitor platform,versions before 2.9.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50943,502;664,Deserialization,airflow/models/xcom.py:BaseXCom._deserialize_value,https://github.com/apache/airflow,detected,implementation (RC1),detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f (RC2),manage/monitor platform,versions before 2.8.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4181,"94;664,707",code injection,llama-index-integrations/llms/llama-index-llms-rungpt/llama_index/llms/rungpt/base.py:RunGptLLM.stream_complete.gen; llama-index-integrations/llms/llama-index-llms-rungpt/llama_index/llms/rungpt/base.py:RunGptLLM.stream_chat.gen,https://github.com/run-llama/llama_index,no rule (RC1),detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),no source (RC1),llm framework,version 0.9.47
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3271,94;707,code injection,llama-index-core/llama_index/core/exec_utils.py:safe_eval,https://github.com/run-llama/llama_index,detected,implementation (RC1),detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),llm framework,-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3098,"94;664,707",code injection,llama-index-core/llama_index/core/exec_utils.py:safe_eval,https://github.com/run-llama/llama_index,detected,implementation (RC1),detected,no rule (RC1),detected,no-source (RC1),no source (RC1),llm framework,-
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-27494,79;707,cross-site scripting,lib/streamlit/components/v1/components.py:ComponentRequestHandler.get; lib/streamlit/server/routes.py:MediaFileHandler.validate_absolute_path,https://github.com/streamlit/streamlit,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no source (RC1),ui framework,versions 0.63.0 through 0.80.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35918,22;664,path traversal,lib/streamlit/components/v1/components.py:ComponentRequestHandler.get,https://github.com/streamlit/streamlit,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),no-source (RC1),no source (RC1),ui framework,resolved in version 1.11.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-1561,22;664,path traversal,gradio/routes.py:App.component_server,https://github.com/gradio-app/gradio,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),complex d/c-f diff (RC3),intrinsic (RC2),complex d/c-f  diff (RC3),"complex d/c-f diff (RC3), inadquate capability (RC2)",ui framework,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21520,79;707,cross-site scripting,rest_framework/templatetags/rest_framework.py:break_long_headers,https://github.com/encode/django-rest-framework,detected,no rule (RC1),no rule (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),web framework,before 3.15.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-30620,22;664,path traversal,mindsdb/api/http/namespaces/file.py:File.put,https://github.com/mindsdb/mindsdb,no rule (RC1),no rule (RC1),implementation (RC1),detected,rule implementation (RC1),detected,no source (RC1),llm framework,"addressed in release 23.2.1.0 "
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23522,22;664,path traversal,mindsdb/interfaces/storage/fs.py:S3FSStore.get,https://github.com/mindsdb/mindsdb,detected,no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),no-source (RC1),no source (RC1),llm framework,addressed in version 22.11.4.3
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-42819,22;664,path traversal,apps/ops/api/playbook.py:PlaybookViewSet.perform_destroy; apps/ops/api/playbook.py:PlaybookViewSet.perform_create; apps/ops/api/playbook.py:PlaybookFileBrowserAPIView.get; apps/ops/api/playbook.py:PlaybookFileBrowserAPIView.post; apps/ops/api/playbook.py:PlaybookFileBrowserAPIView.patch; apps/ops/api/playbook.py:PlaybookFileBrowserAPIView.delete,https://github.com/jumpserver/jumpserver,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no req (RC1),server,addressed in version 3.6.5
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24065,78;707,OS Command Injection,cookiecutter/vcs.py:clone,https://github.com/cookiecutter/cookiecutter,capability (RC3),no rule (RC1),implementation (RC1),rule implementation (RC1),detected,complex d/c-f  diff (RC3),complex d/c-f diff (RC3),dev framework,before 2.1.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7009,89;707,sql injection,src/calibre/db/backend.py:DB.search_annotations; src/calibre/db/fts/connect.py:FTS.search; src/calibre/db/notes/connect.py:Notes.search,https://github.com/kovidgoyal/calibre,detected,no rule (RC1),no rule (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,Calibre <= 7.15.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7008,79;707,cross-site scripting,src/calibre/srv/legacy.py:browse,https://github.com/kovidgoyal/calibre,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,Calibre <= 7.15.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6781,22;664,path traversal,src/calibre/db/backend.py:DB.copy_extra_file_to,https://github.com/kovidgoyal/calibre,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,Calibre <= 7.14.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41127,22;664,path traversal,rasa/model.py:unpack_model; rasa/nlu/persistor.py:Persistor._decompress; rasa/utils/io.py:unarchive,https://github.com/RasaHQ/rasa,no rule (RC1),no rule (RC1),detected,detected,no sink (RC1),detected,interface-source (RC1),ai app framework,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37061,77;707,Command Injection,mlflow/projects/backend/local.py:_run_entry_point,https://github.com/mlflow/mlflow,detected,no rule (RC1),implementation (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,version 1.11.0 or newer
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37060,502;664,Deserialization,mlflow/pipelines/cards/__init__.py:BaseCard.load,https://github.com/mlflow/mlflow,detected,detected,implementation (RC1),no rule (RC1),detected,interface-source (RC1),interface-source (RC1),manage/monitor platform,version 1.27.0 or newer
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37059,502;664,Deserialization,mlflow/pytorch/__init__.py:_load_model,https://github.com/mlflow/mlflow,no rule (RC1),no rule (RC1),no rule (RC1),detected,no sink (RC1),interface-source (RC1),interface-source (RC1),manage/monitor platform,version 0.5.0 or newer
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37058,502;664,Deserialization,mlflow/langchain/utils.py:_load_from_pickle,https://github.com/mlflow/mlflow,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),interface-source (RC1),interface-source (RC1),manage/monitor platform,version 2.5.0 or newer
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3573,22;664,path traversal,mlflow/utils/file_utils.py:mkdir,https://github.com/mlflow/mlflow,capability (RC3),no rule (RC1),no rule (RC1),complex d/c-f (RC3),intrinsic (RC2),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27133,79;707,cross-site scripting,mlflow/recipes/recipe.py:BaseRecipe._get_artifact; mlflow/recipes/steps/ingest/__init__.py:BaseIngestStep._build_step_card,https://github.com/mlflow/mlflow,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-27132,79;707,cross-site scripting,mlflow/recipes/recipe.py:BaseRecipe._get_artifact; mlflow/recipes/steps/ingest/__init__.py:BaseIngestStep._build_step_card,https://github.com/mlflow/mlflow,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6940,94;707,code injection,mlflow/utils/file_utils.py:render_and_merge_yaml,https://github.com/mlflow/mlflow,no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,detected,no sink (RC1),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6709,"94;664,707",code injection,mlflow/recipes/cards/__init__.py:CardTab.to_html,https://github.com/mlflow/mlflow,no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,detected,complex d/c-f source (RC2),manage/monitor platform,prior to 2.9.2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6568,79;707,cross-site scripting,mlflow/server/auth/__init__.py:create_user; mlflow/server/handlers.py:search_datasets_handler; mlflow/server/handlers.py:create_promptlab_run_handler,https://github.com/mlflow/mlflow,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,no source (RC1),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4033,78;707,OS Command Injection,mlflow/pyfunc/backend.py:PyFuncBackend.predict; mlflow/pyfunc/scoring_server/__init__.py:get_cmd,https://github.com/mlflow/mlflow,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),partial detected (RC3),partial detected (RC3),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5926,22;664,path traversal,src/state.py:AgentState.get_project_files,https://github.com/stitionai/devika,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,no source (RC1),webui,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5711,79;707,cross-site scripting,devika.py:project_files; src/apis/project.py:create_project; src/apis/project.py:delete_project; src/apis/project.py:download_project; src/apis/project.py:download_project_pdf,https://github.com/stitionai/devika,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),detected,complex d/c-f  diff (RC3),complex d/c-f diff (RC3),webui,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5548,22;664,path traversal,devika.py:project_files; src/apis/project.py:create_project; src/apis/project.py:delete_project; src/apis/project.py:download_project; src/apis/project.py:download_project_pdf,https://github.com/stitionai/devika,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no source (RC1),webui,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5547,22;664,path traversal,devika.py:project_files; src/apis/project.py:create_project; src/apis/project.py:delete_project; src/apis/project.py:download_project; src/apis/project.py:download_project_pdf,https://github.com/stitionai/devika,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no source (RC1),webui,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35920,22;664,path traversal,sanic/response.py:file; sanic/response.py:file_stream,https://github.com/sanic-org/sanic,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),no sink (RC1),interface-source (RC1),interface-source (RC1),web framework,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28836,79;707,cross-site scripting,wagtail/contrib/modeladmin/views.py:InspectView.get_document_field_display; wagtail/contrib/modeladmin/forms.py:PageChoiceField.label_from_instance,https://github.com/wagtail/wagtail,detected,no rule (RC1),no rule (RC1),detected,detected,complex d/c-f  diff (RC3),complex d/c-f diff (RC3),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11001,79;707,cross-site scripting,wagtail/admin/compare.py:RichTextFieldComparison.htmldiff; wagtail/admin/compare.py:BlockComparison.htmlvalue,https://github.com/wagtail/wagtail,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),implicit sink (RC3),complex d/c-f  diff (RC3),complex d/c-f diff (RC3),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-5187,22;664,path traversal,onnx/hub.py:download_model_with_test_data,https://github.com/onnx/onnx,capability (RC3),no rule (RC1),no rule (RC1),detected,no sink (RC1),detected,interface-source (RC1),ai library,version 1.16.0
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32651,"94;664,707",code injection,changedetectionio/notification.py:process_notification,https://github.com/dgtlmoon/changedetection.io,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),rule implementation (RC1),detected,no sink (RC1),manage/monitor platform,
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-41950,"94;664,707",code injection,haystack/components/builders/chat_prompt_builder.py:ChatPromptBuilder.__init__; haystack/components/builders/chat_prompt_builder.py:ChatPromptBuilder.run; haystack/components/builders/prompt_builder.py:PromptBuilder.__init__; haystack/components/builders/prompt_builder.py:PromptBuilder.run; haystack/components/converters/output_adapter.py:OutputAdapter.__init__; haystack/components/converters/output_adapter.py:OutputAdapter.run; haystack/components/converters/output_adapter.py:OutputAdapter._extract_variables; haystack/components/routers/conditional_router.py:ConditionalRouter.__init__; haystack/components/routers/conditional_router.py:ConditionalRouter.run,https://github.com/deepset-ai/haystack,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,no sink (RC1),llm framework,has been fixed with Haystack 2.3.1
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24816,78;707,OS Command Injection,IPython/utils/terminal.py,https://github.com/ipython/ipython,detected,no rule (RC1),detected,detected,detected,detected,interface-source (RC1),command line tool,Versions prior to 8.1.0
https://www.cve.org/CVERecord?id=CVE-2024-27306,79;707,cross-site scripting,aiohttp/web_urldispatcher.py:StaticResource._directory_as_html,https://github.com/aio-libs/aiohttp,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),complex d/c-f source (RC2),web framework,
https://www.cve.org/CVERecord?id=CVE-2024-23334,22;664,path traversal,aiohttp/web_urldispatcher.py:StaticResource.url_for,https://github.com/aio-libs/aiohttp,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),rule implementation (RC1),interface-source (RC1),interface-source (RC1),web framework,
https://www.cve.org/CVERecord?id=CVE-2021-31607,78;707,OS Command Injection,salt/modules/snapper.py:_is_text_file,https://github.com/saltstack/salt,detected,no rule (RC1),detected,detected,detected,detected,interface-source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2021-3148,77;707,Command Injection,salt/utils/thin.py:get_tops_python,https://github.com/saltstack/salt,detected,no rule (RC1),implementation (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2021-25283,"94;664,707",code injection,salt/utils/templates.py:render_jinja_tmpl,https://github.com/saltstack/salt,no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2019-1010259,89;707,sql injection,salt/modules/mysql.py:user_chpass,https://github.com/saltstack/salt,no rule (RC1),no rule (RC1),no rule (RC1),detected,intrinsic (RC2),complex d/c-f source (RC2),complex d/c-f source (RC2),manage/monitor platform,"SaltStack Salt 2018.3, 2019.2 is affected"
https://www.cve.org/CVERecord?id=CVE-2024-5751,"94;664,707",code injection,litellm/utils.py:get_secret,https://github.com/BerriAI/litellm,detected,detected,detected,no rule (RC1),detected,complex d/c-f env (RC2),"complex d/c-f env (RC2), inadquate capability (RC2)",llm framework,version v1.35.8
https://www.cve.org/CVERecord?id=CVE-2024-4890,89;707,sql injection,litellm/proxy/utils.py:PrismaClient:get_data,https://github.com/BerriAI/litellm,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),complex d/c-f source (RC2),"complex d/c-f source (RC2), inadquate capability (RC2)",llm framework,The affected version is 1.27.14
https://www.cve.org/CVERecord?id=CVE-2022-2054,"94;664,707",code injection,nuitka/__main__.py:main; nuitka/build/SconsCaching.py:checkCachingSuccess; nuitka/nodes/NodeBases.py:fromXML; nuitka/plugins/PluginBase.py:NuitkaPluginBase.queryRuntimeInformationMultiple,https://github.com/Nuitka/Nuitka,detected,detected,detected,no rule (RC1),detected,complex d/c-f env (RC2),complex d/c-f env (RC2),command line tool,
https://www.cve.org/CVERecord?id=CVE-2024-25722,89;707,sql injection,qanything_kernel/connector/database/mysql/mysql_client.py:KnowledgeBaseManager.check_kb_exist; qanything_kernel/connector/database/mysql/mysql_client.py:KnowledgeBaseManager.check_file_exist_by_name; qanything_kernel/connector/database/mysql/mysql_client.py:KnowledgeBaseManager.get_knowledge_base_name; qanything_kernel/connector/database/mysql/mysql_client.py:KnowledgeBaseManager.delete_knowledge_base,https://github.com/netease-youdao/QAnything,no rule (RC1),no rule (RC1),no rule (RC1),detected,intrinsic (RC2),complex d/c-f source (RC2),complex d/c-f (RC2),llm app,
https://www.cve.org/CVERecord?id=CVE-2021-39207,502;664,Deserialization,parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py:ModelChatBlueprint._get_shared_models; parlai/crowdsourcing/tasks/model_chat/model_chat_blueprint.py:ModelImageChatBlueprint._get_shared_models; parlai/chat_service/utils/config.py:parse_configuration_file,https://github.com/facebookresearch/ParlAI,capability (RC3),implementation (RC1),detected,detected,rule implementation (RC1),complex d/c-f source (RC2),no source (RC1),ai library,< 1.1.0 
https://www.cve.org/CVERecord?id=CVE-2024-32027,77;707,Command Injection,kohya_gui/finetune_gui.py:train_model,https://github.com/bmaltais/kohya_ss,detected,no rule (RC1),detected,detected,detected,detected,complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2024-32026,77;707,Command Injection,kohya_gui/git_caption_gui.py:caption_images,https://github.com/bmaltais/kohya_ss,detected,no rule (RC1),detected,detected,detected,detected,complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2024-32025,77;707,Command Injection,kohya_gui/group_images_gui.py:group_images,https://github.com/bmaltais/kohya_ss,detected,no rule (RC1),detected,detected,detected,detected,complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2024-32024,22;664,path traversal,kohya_gui/common_gui.py:add_pre_postfix,https://github.com/bmaltais/kohya_ss,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2024-32023,22;664,path traversal,kohya_gui/common_gui.py:find_replace,https://github.com/bmaltais/kohya_ss,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2018-1000559,79;707,cross-site scripting,qutebrowser/browser/qutescheme.py:history_data,https://github.com/qutebrowser/qutebrowser,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),no sink (RC1),command line tool,
https://www.cve.org/CVERecord?id=CVE-2023-38942,"94;664,707",code injection,ui/settin.py:Settin.getInitConfig,https://github.com/PantsuDango/Dango-Translatorhttps://github.com/PantsuDango/Dango-Translatorhttps://github.com/PantsuDango/Dango-Translatorhttps://github.com/PantsuDango/Dango-Translatorhttps://github.com/PantsuDango/Dango-Translator,detected,detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),app,
https://www.cve.org/CVERecord?id=CVE-2024-27763,77;707,Command Injection,basicsr/utils/dist_util.py:_init_dist_slurm,https://github.com/XPixelGroup/BasicSRhttps://github.com/XPixelGroup/BasicSR,no rule (RC1),no rule (RC1),no rule (RC1),detected,detected,interface-source (RC1),complex d/c-f source (RC2),command line tool,
https://www.cve.org/CVERecord?id=CVE-2016-10516,79;707,cross-site scripting,werkzeug/debug/tbtools.py:Traceback.render_full,https://github.com/pallets/werkzeughttps://github.com/pallets/werkzeughttps://github.com/pallets/werkzeug,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),no sink (RC1),web framework,
https://www.cve.org/CVERecord?id=CVE-2018-8097,"94;664,707",code injection,eve/io/mongo/parser.py:MongoVisitor.visit_Call,https://github.com/pyeve/evehttps://github.com/pyeve/evehttps://github.com/pyeve/eve,detected,detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),web framework,
https://www.cve.org/CVERecord?id=CVE-2024-8374,"94;664,707",code injection,plugins/3MFReader/ThreeMFReader.py:ThreeMFReader._convertSavitarNodeToUMNode,https://github.com/Ultimaker/Curahttps://github.com/Ultimaker/Curahttps://github.com/Ultimaker/Cura,no rule (RC1),detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2023-30605,89;707,sql injection,sql/instance.py:param_edit,https://github.com/hhyo/Archeryhttps://github.com/hhyo/Archeryhttps://github.com/hhyo/Archery,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),partial detected (RC3),complex d/c-f source (RC2),no sink (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-30558,89;707,sql injection,sql/data_dictionary.py:table_list,https://github.com/hhyo/Archeryhttps://github.com/hhyo/Archeryhttps://github.com/hhyo/Archery,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),partial detected (RC3),complex d/c-f source (RC2),no sink (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-30557,89;707,sql injection,sql/data_dictionary.py:table_info,https://github.com/hhyo/Archeryhttps://github.com/hhyo/Archeryhttps://github.com/hhyo/Archery,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),partial detected (RC3),complex d/c-f source (RC2),no sink (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2024-41810,79;707,cross-site scripting,src/twisted/web/_template_util.py:redirectTo,https://github.com/twisted/twistedhttps://github.com/twisted/twistedhttps://github.com/twisted/twisted,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),no sink (RC1),dev framework,
https://www.cve.org/CVERecord?id=CVE-2022-39348,79;707,cross-site scripting,src/twisted/web/vhost.py:NameVirtualHost._getResourceForRequest,https://github.com/twisted/twistedhttps://github.com/twisted/twistedhttps://github.com/twisted/twisted,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),no sink (RC1),dev framework,
https://www.cve.org/CVERecord?id=CVE-2021-43775,22;664,path traversal,aim/web/api/views.py:serve_static_files,https://github.com/aimhubio/aimhttps://github.com/aimhubio/aimhttps://github.com/aimhubio/aim,detected,no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no sink (RC1),webui,
https://www.cve.org/CVERecord?id=CVE-2021-21386,78;707,OS Command Injection,apkleaks/apkleaks.py:APKLeaks.decompile,https://github.com/dwisiswant0/apkleakshttps://github.com/dwisiswant0/apkleakshttps://github.com/dwisiswant0/apkleaks,detected,no rule (RC1),detected,detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),command line tool,
https://www.cve.org/CVERecord?id=CVE-2022-24710,79;707,cross-site scripting,weblate/trans/views/reports.py:get_credits; weblate/trans/views/reports.py:get_counts,https://github.com/WeblateOrg/weblatehttps://github.com/WeblateOrg/weblatehttps://github.com/WeblateOrg/weblate,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),no-source (RC1),no sink (RC1),app,
https://www.cve.org/CVERecord?id=CVE-2020-11010,89;707,sql injection,tortoise/backends/mysql/executor.py:mysql_contains; tortoise/backends/mysql/executor.py:mysql_starts_with; tortoise/backends/mysql/executor.py:mysql_ends_with; tortoise/backends/mysql/executor.py:mysql_insensitive_contains; tortoise/backends/mysql/executor.py:mysql_insensitive_starts_with; tortoise/backends/mysql/executor.py:mysql_insensitive_ends_with; tortoise/filters.py:contains; tortoise/filters.py:starts_with; tortoise/filters.py:ends_with; tortoise/filters.py:insensitive_contains; tortoise/filters.py:insensitive_starts_with; tortoise/filters.py:insensitive_ends_with,https://github.com/tortoise/tortoise-ormhttps://github.com/tortoise/tortoise-ormhttps://github.com/tortoise/tortoise-ormhttps://github.com/tortoise/tortoise-ormhttps://github.com/tortoise/tortoise-orm,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),partial detected (RC3),complex d/c-f source (RC2),no sink (RC1),ORM,
https://www.cve.org/CVERecord?id=CVE-2023-41040,22;664,path traversal,git/refs/symbolic.py:SymbolicReference._get_ref_info_helper,https://github.com/gitpython-developers/GitPythonhttps://github.com/gitpython-developers/GitPythonhttps://github.com/gitpython-developers/GitPythonhttps://github.com/gitpython-developers/GitPythonhttps://github.com/gitpython-developers/GitPython,capability (RC3),no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),complex d/c-f source (RC2),complex d/c-f source (RC2),dev framework,
https://www.cve.org/CVERecord?id=CVE-2024-41675,79;707,cross-site scripting,ckanext/datatablesview/blueprint.py:ajax,https://github.com/ckan/ckanhttps://github.com/ckan/ckanhttps://github.com/ckan/ckan,hard to detect (RC3),hard_to_detect (RC3),hard to detect (RC3),no rule (RC1),implicit sink (RC3),complex d/c-f source (RC2),no sink (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-41334,77;707,Command Injection,astropy/coordinates/transformations.py:TransformGraph.to_dot_graph,https://github.com/astropy/astropyhttps://github.com/astropy/astropyhttps://github.com/astropy/astropy,detected,no rule (RC1),implementation (RC1),detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),dev framework,
https://www.cve.org/CVERecord?id=CVE-2022-21797,"94;664,707",code injection,joblib/parallel.py:Parallel.__call__,https://github.com/joblib/joblibhttps://github.com/joblib/joblibhttps://github.com/joblib/joblib,capability (RC3),detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),dev framework,
https://www.cve.org/CVERecord?id=CVE-2025-27519,22;664,path traversal,backend/server/routers/internal.py:upload_to_docker_directory,https://github.com/truefoundry/cognitahttps://github.com/truefoundry/cognitahttps://github.com/truefoundry/cognita,detected,no rule (RC1),no rule (RC1),no rule (RC1),no sink (RC1),detected,no sink (RC1),ai app framework,
https://www.cve.org/CVERecord?id=CVE-2024-11662,"94;664,707",code injection,apps/api/views/deploy_api.py:deploy_host_vars,https://github.com/welliamcao/OpsManagehttps://github.com/welliamcao/OpsManagehttps://github.com/welliamcao/OpsManage,detected,detected,detected,no rule (RC1),detected,detected,no source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2021-43857,78;707,OS Command Injection,gerapy/server/core/views.py:project_configure; gerapy/server/core/views.py:project_clone; gerapy/server/core/views.py:project_parse,https://github.com/Gerapy/Gerapyhttps://github.com/Gerapy/Gerapyhttps://github.com/Gerapy/Gerapy,implementation (RC1),no rule (RC1),detected,detected,detected,detected,no source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-38941,94;664;707,code injection,apps/sspanel/admin_views.py:GoodsCreateView.post,https://github.com/Ehco1996/django-sspanelhttps://github.com/Ehco1996/django-sspanelhttps://github.com/Ehco1996/django-sspanelhttps://github.com/Ehco1996/django-sspanelhttps://github.com/Ehco1996/django-sspanel,capability (RC3),detected,detected,no rule (RC1),detected,detected,complex d/c-f source (RC2),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-50265,22;664,path traversal,bazarr/app/ui.py:swaggerui_static,https://github.com/morpheus65535/bazarrhttps://github.com/morpheus65535/bazarrhttps://github.com/morpheus65535/bazarr,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,no source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2023-50264,22;664,path traversal,bazarr/app/ui.py:backup_download,https://github.com/morpheus65535/bazarrhttps://github.com/morpheus65535/bazarrhttps://github.com/morpheus65535/bazarr,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,no source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2021-41185,22;664,path traversal,mycodo/mycodo_flask/routes_general.py:send_note_attachment; mycodo/mycodo_flask/routes_general.py:camera_img_return_path,https://github.com/kizniche/Mycodohttps://github.com/kizniche/Mycodohttps://github.com/kizniche/Mycodo,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,no source (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2018-1000070,94;664;707,code injection,src/messagetypes/__init__.py:constructObject,https://github.com/Bitmessage/PyBitmessagehttps://github.com/Bitmessage/PyBitmessagehttps://github.com/Bitmessage/PyBitmessage,detected,detected,detected,no rule (RC1),detected,complex d/c-f source (RC2),complex d/c-f source (RC2),dev framework,
https://www.cve.org/CVERecord?id=CVE-2012-4406,502;664,Deserialization,swift/common/memcached.py:MemcacheRing.get; swift/common/memcached.py:MemcacheRing.get_multi,https://github.com/openstack/swifthttps://github.com/openstack/swifthttps://github.com/openstack/swift,implementation (RC1),no rule (RC1),implementation (RC1),no rule (RC1),rule implementation (RC1),complex d/c-f source (RC2),complex d/c-f source (RC2),command line tool,
https://www.cve.org/CVERecord?id=CVE-2024-6345,77;707,Command Injection,setuptools/package_index.py:PackageIndex._download_git; setuptools/package_index.py:PackageIndex._download_hg,https://github.com/pypa/setuptoolshttps://github.com/pypa/setuptoolshttps://github.com/pypa/setuptools,detected,no rule (RC1),detected,detected,detected,detected,complex d/c-f source (RC2),command line tool,
https://www.cve.org/CVERecord?id=CVE-2021-25963,79;707,cross-site scripting,shuup/admin/utils/urls.py:AdminRegexURLPattern._get_unauth_response; shuup/core/basket/command_dispatcher.py:BasketCommandDispatcher.handle; shuup/front/checkout/_process.py:CheckoutProcess.get_current_phase; shuup/front/urls.py:_not_here_yet; shuup/xtheme/views/command.py:command_dispatch; shuup/xtheme/views/editor.py:EditorView.post; shuup/xtheme/views/extra.py:extra_view_dispatch,https://github.com/shuup/shuuphttps://github.com/shuup/shuuphttps://github.com/shuup/shuup,no rule (RC1),no rule (RC1),no rule (RC1),no rule (RC1),implicit sink (RC3),detected,no sink (RC1),manage/monitor platform,
https://www.cve.org/CVERecord?id=CVE-2017-16667,78;707,OS Command Injection,qt4/plugins/notifyplugin.py:NotifyPlugin.on_message,https://github.com/jupyter/nbviewerhttps://github.com/jupyter/nbviewerhttps://github.com/jupyter/nbviewer,detected,no rule (RC1),detected,detected,detected,complex d/c-f source (RC2),complex d/c-f source (RC2),webui,
https://www.cve.org/CVERecord?id=CVE-2025-27787,22;664,path traversal,tabs/settings/sections/restart.py:stop_train,https://github.com/IAHispano/Appliohttps://github.com/IAHispano/Appliohttps://github.com/IAHispano/Applio,detected,no rule (RC1),no rule (RC1),no rule (RC1),rule implementation (RC1),detected,complex d/c-f source (RC2),command line tool,