152 matches found
TorchServe vulnerable to bypass of allowed_urls configuration
Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...
[SECURITY] Fedora 40 Update: onnx-1.14.1-3.fc40
onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...
CVE-2024-37902
Summary: CVE-2024-37902 affects the Java DeepJavaLibrary (DJL) up to version 0.27.0. The root cause is an absolute-path handling flaw in archived artifacts that can insert files directly into the system and overwrite system files. The issue is fixed in DJL v0.28.0 and also patched in the DJL Larg...
CVE-2024-37902 Path thraversal in DeepJavaLibrary
DeepJavaLibraryDJL is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model...
Deep Java Library Security Vulnerability
Deep Java Library is an open source, high-level, engine-independent deep learning Java framework from Deep Java Library Open Source. A security vulnerability exists in Deep Java Library that stems from improper validation of file paths during tar file extraction...
[SECURITY] Fedora 39 Update: onnx-1.14.0-9.fc39
onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...
[SECURITY] Fedora 40 Update: onnx-1.14.1-2.fc40
onnx provides an open source format for AI models, both deep learning and traditional ML. It defines an extensible computation graph model, as well as definitions of built-in operators and standard data types...
Fedora: Security Advisory (FEDORA-2024-abe1e34fdb)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Fedora: Security Advisory (FEDORA-2024-270e3b5e9b)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
paddlepaddle code injection vulnerability
PaddlePaddle PaddlePaddle is an independent R&D deep learning platform open-sourced by China's PaddlePaddle PaddlePaddle. A code injection vulnerability exists in paddlepaddle version 2.6.0, which stems from the application failing to properly filter special elements of constructed code segments...
Announcing TotalCloud™ 2.0 with TruRisk™ Insights: The Future of Cloud and SaaS Security
Rapid cloud and SaaS adoption is driving digital transformation thats reshaping business agility and scalability, making cloud and SaaS security more critical than ever. Recognizing this shift, in November 2022, Qualys launched TotalCloud – an AI-powered cloud-native application protection platfo...
The sound of you typing on your keyboard could reveal your password
As if password authentications coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. The technique, developed at Durham University, the University of Surrey, and Royal Holloway University of London, builds on previous work to produce a more accurate...
The sound of you typing on your keyboard could reveal your password
As if password authentications coffin needed any more nails, researchers in the UK have discovered yet another way to hammer one in. The technique, developed at Durham University, the University of Surrey, and Royal Holloway University of London, builds on previous work to produce a more accurate...
NVIDIA DGX Input Validation Error Vulnerability
NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in the NVIDIA DGX H100 BMC that stems from incorrect input validation...
NVIDIA DGX Input Validation Error Vulnerability
NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. The NVIDIA DGX H100 BMC suffers from an input validation error vulnerability that stems from an input validation error vulnerability in the Web UI. An attacker could exploit this vulnerability to cause code...
NVIDIA DGX Security Vulnerability
NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in the NVIDIA DGX H100 BMC, which stems from a security flaw in IPMI that can be exploited by attackers to cause code execution, denial of service, privilege escalation, and...
Using Machine Learning to Detect Keystrokes
Researchers have trained a ML model to detect keystrokes by sound with 95% accuracy. "A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards" Abstract: With recent developments in deep learning, the ubiquity of microphones and the rise in online services via personal devices,...
New 'Deep Learning Attack' Deciphers Laptop Keystrokes with 95% Accuracy
A group of academics has devised a "deep learning-based acoustic side-channel attack" that can be used to classify laptop keystrokes that are recorded using a nearby phone with 95% accuracy. "When trained on keystrokes recorded using the video conferencing software Zoom, an accuracy of 93% was...
Beating the Challenge of Cloud Detection and Response with Qualys TotalCloud Deep Learning AI
Lets go beyond the limitations of configuration management-only, non-cloud-native EDR tools for threat detection & response using deep learning AI. The global adoption of cloud technology has supercharged agile innovation in virtually every business sector. As a result, organizations are now...
NVIDIA DGX 安全漏洞
NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in NVIDIA DGX A100/A800. An attacker could exploit the vulnerability to cause a denial of service, information disclosure, and data tampering...