NVFlare (NVIDIA Federated Learning Application Runtime Environment) is an open source SDK for Federated Learning. Institutions can collaborate on ML model training in a privacy-preserving way. …

While investigating the Docker web-GUI “Fast OS Docker”, I came across a “Use of Password Hash Instead of Password for Authentication” vulnerability (CWE-836). An attacker who knows the contents of the configuration file (which may be leaked due to another LFI, Path Traversal or XXE vulnerability) can log in to…

I discovered an authenticated SQL injection vulnerability in the “NEX Forms” Wordpress plugin, which has at the time of writing around 10k active installations. NEX-Forms - Ultimate Form Builder - Contact forms and much more NEX-Forms is the best WordPress Form Builder plugin for creating simple to complex forms. With tons off add-ons and…wordpress.org Versions up to an including 7.9.6 are vulnerable. The developer released a patched version around two weeks after I informed him of the bug.

I recently had a look at camp , a Raspberry Pi camera server based on Python with more than 100 stars on Github. It uses the Tornado framework and supports username-password authentication. When we start the application via python3 server.py …

While investigating Wordpress plugins, I stumbled upon “Translatepress Multilingual”, which is used to make Wordpress pages available in multiple languages and has 200,000 active installations. Translate Multilingual sites - TranslatePress Experience a better way to translate your WordPress site and go multilingual, directly from the front-end using a…wordpress.org WordPress Translation Plugin - TranslatePress A WordPress translation plugin that anyone can use. Experience a better way of translating your WordPress site, with…translatepress.com

There is an Unauthenticated Remote Code Execution vulnerability in https://pypi.org/project/rpc.py/. No specific configuration is required, it works with the scripts from the “examples” folder. Versions v0.4.2 to v0.6.0 (latest) are affected. The maintainer has not replied to my emails in a time frame of two weeks, so I decided to…

Recently, I discovered an unauthenticated Remote Code Execution vulnerability in a development feature of EdgeDB called “remote compiler pool server”. Fortunately, the bug was not yet included in any production release and only installed if you decided to build from source. Furthermore, EdgeDB needs to be started with a specific…