Vulnerabilities

TI-2023-15237 CVE-2023-31847 · GHSA-46h7-97pw-fqv3

In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server…

MEDIUM 62

In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client side.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00629 Published 2023-05-17 No fix listed

TI-2023-15238 CVE-2023-31848 · GHSA-8cmw-3vx6-7qg4

davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).

HIGH 73

davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.006 Published 2023-05-16 No fix listed CWE-918

TI-2023-09932 CVE-2023-24206 · GHSA-6xwm-gvm9-8cff

Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.

MEDIUM 50

Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00741 Published 2023-02-27 No fix listed CWE-89

Vulnerabilities

Filters

In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server…

davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).

Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.