PT-2024-9134 · Tenda · Tenda Ac1206 +8

Name of the Vulnerable Software and Affected Versions: Tenda AC6, AC7, AC8, AC9, AC10, AC10U, AC15, AC18, AC500, and AC1206 versions up to 20241022 Description: A vulnerability was found in the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length lea...

Leverage the Power of 45k, free, Hugging Face Models with Spring AI and Ollama

This blog post is co-authored by our great contributor Thomas Vitale. Ollama now supports all GGUF models from Hugging Face , allowing access to over 45,000 community-created models through Spring AI's Ollama integration, runnable locally. We'll explore using this new feature with Spring AI. The...

CVE-2024-10193

A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028 and classified as critical. This issue affects the function pingddns of the file internet.cgi. The manipulation of the argument DDNS leads to command injection. The attack may be initiated remotely. The exploit has...

CVE-2024-10073

A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The...

Malicious code in @taxify/price-estimate-helper-models (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9474 Malicious code in @taxify/price-estimate-helper-models (npm)

--- -= Per source details. Do not edit below this line.=-...

MOXA Service 安全漏洞

MOXA Service is a hardware device infrastructure service from China MOXA MOXA. A security vulnerability exists in MOXA Service, which stems from a lack of authentication during command sending and could allow an attacker to execute specific commands, resulting in unauthorized configuration file...

BIT-MLFLOW-2024-3099

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service DoS as an authenticated user might not be able to use the intended model, as it will open a different model each time...

SAMSUNG多款产品 安全漏洞

SAMSUNG Exynos and others are products of the South Korean company Samsung.SAMSUNG Exynos is a SoC, Arm architecture based processor developed and manufactured by Samsung Mobile.SAMSUNG Mobile Processor is a series of mobile processors.SAMSUNG SAMSUNG Mobile Processor is a family of mobile...

Splunk Enterprise Privilege Escalation Command Injection

The vulnerability of Splunk Enterprise’s External Lookups technology relates to the improper elimination of certain elements used in the operating system’s command set. This occurs due to the use of data models for detecting unauthorized searches called SearchActivity. Exploiting this vulnerabili...

CVE-2024-7048

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

CVE-2024-7048 IDOR in open-webui/open-webui

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

CVE-2024-7048

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

CVE-2024-7048

Open-WebUI open-webui v0.3.8 contains an improper privilege management flaw in API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc, enabling a lower-privileged user to view and overwrite admin-owned files, risking integrity and availability of RAG models. Root cause: insufficient access...

CVE-2024-7048 IDOR in open-webui/open-webui

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

CVE-2024-7048 IDOR in open-webui/open-webui

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

CVE-2024-7048: Incorrect Authorization

In version v0.3.8 of open-webui, an improper privilege management vulnerability exists in the API endpoints GET /api/v1/documents/ and POST /rag/api/v1/doc. This vulnerability allows a lower-privileged user to access and overwrite files managed by a higher-privileged admin. By exploiting this...

A Single Cloud Compromise Can Feed an Army of AI Sex Bots

Organizations that get relieved of credentials to their cloud environments can quickly find themselves part of a disturbing new trend: Cybercriminals using stolen cloud credentials to operate and resell sexualized AI-powered chat services. Researchers say these illicit chat bots, which use custom...

Supercharging Your AI Applications with Spring AI Advisors

In the rapidly evolving world of artificial intelligence, developers are constantly seeking ways to enhance their AI applications. Spring AI, a Java framework for building AI-powered applications, has introduced a powerful feature: the Spring AI Advisors. The advisors can supercharge your AI...

MAI-2024-0023

The multi-round jailbreak attack targets Large Language Models LLMs by exploiting their iterative prompt-response mechanisms to bypass established safety protocols. This attack method involves progressively refining prompts over multiple interactions, thereby inducing the LLM to produce unintende...