LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version 9.6 that stems from vulnerability to a path traversal attack, which allows an attacker to write an audio file to an arbitrary location on the...

Astra Linux – Vulnerability in Chromium

The use of “after free” in Audio in Google Chrome before version 126.0.6478.54 allowed a remote attacker to potentially exploit heap corruption through a crafted PDF file. Chromium security severity: Medium...

Malicious code in audio-mixer-sox (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6720 Malicious code in audio-mixer-sox (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-1782 Malicious code in audio-only-web (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in audio-only-web (npm)

--- -= Per source details. Do not edit below this line.=-...

SUSE CVE-2024-38628

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks...

CVE-2024-4499

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499 CSRF Vulnerability in parisneo/lollms XTTS Server

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

CVE-2024-4499

CVE-2024-4499 describes a CSRF vulnerability in the XTTS server of parisneo/lollms 9.6 caused by a lax CORS policy. An attacker can lure a user to a malicious page to trigger arbitrary LoLLMS-XTTS API requests, potentially leading to reading/writing of audio files and, in combination with other i...

PT-2024-9820 · Microsoft · High Definition Audio Bus Driver

Name of the Vulnerable Software and Affected Versions: Microsoft High Definition Audio Bus Driver version 10.0.19041.3636 Description: A mishandling of IRP requests vulnerability exists in the HDAudBus DMA interface of Microsoft High Definition Audio Bus Driver. This vulnerability can be exploite...

PT-2024-31349 · Lollms +1 · Lollms +2

Name of the Vulnerable Software and Affected Versions: lollms version 9.6 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server due to a lax CORS policy, allowing attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage. This...

SUSE CVE-2022-48717

In the Linux kernel, the following vulnerability has been resolved: ASoC: max9759: fix underflow in speakergaincontrolput Check for negative values of "priv-gain" to prevent an out of bounds access. The concern is that these might come from the user via: - sndctlelemwriteuser - sndctlelemwrite -...

SUSE CVE-2022-48738

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in sndsocputvolsw We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range...

SUSE CVE-2024-38551

In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Assign dummy when codec not specified for a DAI link MediaTek sound card drivers are checking whether a DAI link is present and used on a board to assign the correct parameters and this is done by checking the cod...

AZL-58983 CVE-2024-38628 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uaudio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks...

DEBIAN-CVE-2024-38388

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/csdspctl: Use privatefree for control cleanup Use the control privatefree callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed. The original...

UBUNTU-CVE-2024-38388

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/csdspctl: Use privatefree for control cleanup Use the control privatefree callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed. The original...