ClearML and Nvidia vulns

Summary: Cisco Talos disclosed two vulnerabilities in the open-source AI platform ClearML and four in Nvidia's nvJPEG2000 library, all of which have been patched by their vendors. The ClearML flaws are a cross-site scripting issue (CVE-2024-39272) allowing HTML upload to a dataset and an information disclosure issue (CVE-2024-43779) allowing an attacker to read previously disabled vaults, while the Nvidia flaws are memory corruption and heap-based buffer overflow bugs triggered by a crafted JPEG2000 file that can lead to arbitrary code execution.
What's compelling: The ClearML information disclosure bug can expose sensitive credentials from vaults that were disabled, and the Nvidia flaws let a single malicious JPEG2000 file reach arbitrary code execution on a CUDA-enabled GPU system.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-0142 CVE-2024-0143 CVE-2024-0144 CVE-2024-0145 CVE-2024-39272 CVE-2024-43779
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026