CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

LLaMA-Factory 操作系统命令注入漏洞

LLaMA-Factory is a fine-tuned large-scale language model by a Chinese hoshi-hiyouga individual developer. A cross-site scripting vulnerability exists in LLaMA-Factory version 0.9.0 and earlier, which stems from improper handling of user input and allows malicious actors to execute arbitrary...

PT-2024-35454

Name of the Vulnerable Software and Affected Versions LLama Factory versions =0.9.0 Description A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This issue arises from improper handling of user input, allowing malicious actors to...

CVE-2024-52803: Improper Neutralization of Input During Web Page Generation

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

Insyde InsydeH2O 安全漏洞

Insyde InsydeH2O is a new EFI/UEFI specification from Insyde China. It is intended to replace the traditional BIOS Basic Input/Output System. A security vulnerability exists in Insyde InsydeH2O, which stems from a 0x49 function that can restore the factory default settings of certain UEFI variabl...

SUSE-SU-2024:3964-1 Security update for python-wxPython

This update for python-wxPython fixes the following issues: Security issue fixed: - CVE-2024-50602: Fixed a denial of service in the vendored libexpat's XMLResumeParser function bsc1232590. Non-security issues fixed: - rebuilt for python 3.11 bsc1228252. - add repack script, do not include...

PT-2024-34534 · Unknown · Powertac-Server

Name of the Vulnerable Software and Affected Versions: powertac-server version 1.9.0 Description: An XML External Entity XXE vulnerability in the component DocumentBuilderFactory allows attackers to access sensitive information or execute arbitrary code via supplying a crafted request containing...

CVE-2024-9925

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925 SQL injection in QPLANT by TAI Smart Factory

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925

CVE-2024-9925 describes a SQL injection in QPLANT SF 1.0 by TAI Smart Factory. The vulnerability allows a remote attacker to exfiltrate all database information by crafting a SQL payload against the email parameter on the RequestPasswordChange endpoint. Impact is high (confidentiality, integrity,...

CVE-2024-9925 SQL injection in QPLANT by TAI Smart Factory

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

CVE-2024-9925: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in TAI Smart Factory's QPLANT SF version 1.0. Exploitation of this vulnerability could allow a remote attacker to retrieve all database information by sending a specially crafted SQL query to the ‘email’ parameter on the ‘RequestPasswordChange’ endpoint...

PT-2024-40598 · Apache · Apache Poi

Name of the Vulnerable Software and Affected Versions: Apache POI affected versions not specified Description: A security exception crash has been reported in Apache POI. The crash occurs in the java.base/java.lang.Short.valueOf function, which is called by...

PT-2024-28981 · Google · Android

Name of the Vulnerable Software and Affected Versions: AdvancedPowerUsageDetail.java affected versions not specified Description: There is a possible way to bypass factory reset protections due to a missing permission check in the shouldSkipForInitialSUW function of AdvancedPowerUsageDetail.java...

PT-2024-28979 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android ChooserActivity affected versions not specified Description: The issue is related to a missing permission check in the onCreate method of ChooserActivity.java. This could allow an attacker to bypass factory reset protections, leading ...

ASB-A-327748846

In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

ASB-A-327645387

In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-40087 · Unknown +1 · Phpspreadsheet +1

Name of the Vulnerable Software and Affected Versions: Kimai versions affected versions not specified PHPSpreadsheet versions affected versions not specified Description: The issue is related to an XXE vulnerability in PHPSpreadsheet, which is used by Kimai for importing and exporting invoices...

CVE-2024-6077

A denial-of-service vulnerability exists in the Rockwell Automation affected products when specially crafted packets are sent to the CIP Security Object. If exploited the device will become unavailable and require a factory reset to recover...