Aggregates CVE and security vulnerability intelligence across all davinci_project-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Common weakness patterns include vendor risk sql injection and vendor risk ssrf, with potential vendor impact data exposure across vendor surface production workloads and vendor surface software deployment use cases.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2023-31847 | In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client side. | [email protected] | 6.5 | 0.63% | 2023-05-17 | 2025-01-22 |
| CVE-2023-31848 | davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF). | [email protected] | 8.8 | 0.60% | 2023-05-17 | 2025-01-23 |
| CVE-2023-24206 | Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function. | [email protected] | 9.8 | 0.74% | 2023-02-27 | 2024-11-21 |