CVE-2024-12029

Summary: CVE-2024-12029 affects invoke-ai/invokeai prior to 5.4.3, via unsafe deserialization in the /api/v2/models/install API, leading to remote code execution when loading model files through torch.load. Affected software: invoke-ai/invokeai, versions 5.3.1 through 5.4.2 (and up to 5.4.2 per s...

CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-12029

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

PT-2025-12067

Name of the Vulnerable Software and Affected Versions Invoke-AI server version v5.0.1 Description A Denial of Service DoS issue exists in the multipart request boundary processing mechanism, allowing unauthenticated attackers to cause excessive resource consumption by appending excessive characte...

PT-2025-12094

Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2 Description The web API POST /api/v1/images/delete is vulnerable to Arbitrary File Deletion, allowing unauthorized attackers to delete arbitrary files on the server. This can include critical or sensitive syst...

CVE-2024-12029: Deserialization of Untrusted Data

A remote code execution vulnerability exists in invoke-ai/invokeai versions 5.3.1 through 5.4.2 via the /api/v2/models/install API. The vulnerability arises from unsafe deserialization of model files using torch.load without proper validation. Attackers can exploit this by embedding malicious cod...

CVE-2024-11043: Uncontrolled Resource Consumption

A Denial of Service DoS vulnerability was discovered in the /api/v1/boards/boardid endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the boardname field during a PATCH request. By sending a large payload, the UI becomes...

CVE-2024-10821: Loop with Unreachable Exit Condition

A Denial of Service DoS vulnerability in the multipart request boundary processing mechanism of the Invoke-AI server version v5.0.1 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to the end of multipart boundaries...

Invoke security vulnerabilities

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. A security vulnerability exists in Invoke versions 5.3.1 through 5.4.2, which stems from improper deserialization of model files and could lead to remote code execution...

Invoke security vulnerabilities

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. A security vulnerability exists in Invoke version v5.0.2, which stems from a denial of service attack vulnerability in the /api/v1/boards/boardid endpoint...

Invoke resource management error vulnerability

Invoke is a leading creative engine for stabilizing diffusion models in InvokeAI open source. A resource management error vulnerability exists in Invoke v5.0.1, which stems from a flaw in the multipart request boundary handling mechanism that allows an unauthenticated user to cause a denial of...

Invoke input validation vulnerability

Invoke is a leading creative engine for stabilizing diffusion models open-sourced by InvokeAI. An input validation error vulnerability exists in Invoke version v5.0.2, which stems from an arbitrary file deletion vulnerability in the POST /api/v1/images/delete API...

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application...

Azure File Sync Agent v14 Release – October 2021

Azure File Sync Agent v14 Release – October 2021 This article describes the improvements and issues that are fixed in the Azure File Sync Agent v14 release that is dated October 2021. Additionally, this article contains installation instructions for this release. Improvements and issues that are...

October 19, 2021 preview update (KB5006741)

October 19, 2021 preview update KB5006741 Applies To Azure Local, version 20H2 Improvements and fixes This non-security update includes quality improvements. Key changes include: Provides the ability in Cluster-Aware Updating CAU to start a one-time, self-updating run on the cluster by running...

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application...

CVE-2024-21469

CVE-2024-21469 is mapped to Qualcomm TZ Secure OS / embedded platform where memory corruption occurs when an invoke call and a TEE call are bound to the same trusted application. The Red Hat/Qualcomm/PT-Security entries describe the issue as memory corruption with potential for arbitrary code exe...

CVE-2024-21469: Out-of-bounds Write

Memory corruption when an invoke call and a TEE call are bound for the same trusted application...

SUSE CVE-2024-38572

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix out-of-bound access of qmiinvokehandler Currently, there is no terminator entry for ath12kqmimsghandlers hence facing below KASAN warning, ================================================================== BUG:...