CVE-2024-11042 Arbitrary File Delete in invoke-ai/invokeai

In invoke-ai/invokeai version v5.0.2, the web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion. This vulnerability allows unauthorized attackers to delete arbitrary files on the server, potentially including critical or sensitive system files such as SSH keys, SQLite...

CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-12029

Summary: CVE-2024-12029 affects invoke-ai/invokeai prior to 5.4.3, via unsafe deserialization in the /api/v2/models/install API, leading to remote code execution when loading model files through torch.load. Affected software: invoke-ai/invokeai, versions 5.3.1 through 5.4.2 (and up to 5.4.2 per s...

CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

Invoke 安全漏洞

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. A security vulnerability exists in Invoke versions 5.3.1 through 5.4.2, which stems from improper deserialization of model files and could lead to remote code execution...

Invoke 安全漏洞

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. A security vulnerability exists in Invoke version v5.0.2, which stems from a denial of service attack vulnerability in the /api/v1/boards/boardid endpoint...

Invoke 资源管理错误漏洞

Invoke is a leading creative engine for stabilizing diffusion models in InvokeAI open source. A resource management error vulnerability exists in Invoke v5.0.1, which stems from a flaw in the multipart request boundary handling mechanism that allows an unauthenticated user to cause a denial of...

Invoke 输入验证错误漏洞

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. An input validation error vulnerability exists in Invoke version v5.0.2, which stems from an arbitrary file deletion vulnerability in the POST /api/v1/images/delete API...

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application...

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application...

CVE-2024-21469

CVE-2024-21469 is mapped to Qualcomm TZ Secure OS / embedded platform where memory corruption occurs when an invoke call and a TEE call are bound to the same trusted application. The Red Hat/Qualcomm/PT-Security entries describe the issue as memory corruption with potential for arbitrary code exe...

SUSE CVE-2024-38572

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmiinvokehandler Currently, there is no terminator entry for ath12kqmimsghandlers hence facing below KASAN warning, ================================================================== BUG:...

DEBIAN-CVE-2024-38572

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmiinvokehandler Currently, there is no terminator entry for ath12kqmimsghandlers hence facing below KASAN warning, ================================================================== BUG:...

CVE-2023-43538

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization...

CVE-2023-43538 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization...

CVE-2023-43538 Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OS

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization...

PT-2024-13111 · Unknown · Tz Secure Os

Name of the Vulnerable Software and Affected Versions: TZ Secure OS affected versions not specified Description: The issue concerns memory corruption in TZ Secure OS during the initialization of the Tunnel Invoke Manager. Recommendations: At the moment, there is no information about a newer versi...

CVE-2024-22131

In SAP ABA Application Basis - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an application function to perform actions...

PT-2024-5261 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to a memory corruption problem that occurs when an invoke call and a TEE call are bound for the same trusted application. It is also...

Tater

It is an offensive tool for Windows Privilege Escalation. The primary CVE ID is not explicitly mentioned, but the tool is based on the Hot Potato Windows Privilege Escalation exploit, which is a known vulnerability. The target product/service is Windows, and the vulnerability class/vector is...