aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-48052 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-48052 Source advisory: OSV:GHSA-3GF9-WV65-GWH9...

Google's AI Tool Big Sleep Finds Zero-Day Vulnerability in SQLite Database Engine

Google said it discovered a zero-day vulnerability in the SQLite open-source database engine using its large language model LLM assisted framework called Big Sleep formerly Project Naptime. The tech giant described the development as the "first real-world vulnerability" uncovered using the...

CVE-2024-7783 Improper Storage of Sensitive Information in Bearer Token in mintplex-labs/anything-llm

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT JSON Web Token used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of...

CVE-2024-7783

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT JSON Web Token used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of...

PT-2024-38577

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.0.3 Description The issue concerns the improper storage of sensitive information, specifically a password, within a JSON Web Token JWT used as a bearer token in single user mode. When decoded, the...

CVE-2024-7783: Cleartext Storage of Sensitive Information

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT JSON Web Token used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of...

Watermark for LLM-Generated Text

Researchers at Google have developed a watermark for LLM-generated text. The basics are pretty obvious: the LLM chooses between tokens partly based on a cryptographic key, and someone with knowledge of the key can detect those choices. What makes this hard is 1 how much text is required for the...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

PT-2024-10269 · Unknown · Llm Lunary

Name of the Vulnerable Software and Affected Versions: LLM Lunary affected versions not specified Description: The issue is related to insufficient access control mechanisms in the LLM Lunary platform, which is used for monitoring, managing, and improving applications. This can be exploited by a...

RAGFlow command injection vulnerability

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A command injection vulnerability exists in RAGFlow version 0.11.0, which stems from a lack of comprehensive input validation or cleanup, causing the addllm function in llmapp.py to contain a...

PT-2024-16051 · Infiniflow · Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version 0.11.0 Description: The issue concerns a remote code execution vulnerability in the add llm function, located in llm app.py. This function utilizes user-supplied input, specifically req'llm factory' and req'llm name...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-47870 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-47870 Source advisory: OSV:PYSEC-2024-218...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47870 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47870 Source advisory: OSV:PYSEC-2024-218...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47872 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47872 Source advisory: OSV:PYSEC-2024-220...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47871 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47871 Source advisory: OSV:PYSEC-2024-219...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-47871 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-47871 Source advisory: OSV:PYSEC-2024-219...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47867 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47867 Source advisory: OSV:PYSEC-2024-216...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47869 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47869 Source advisory: OSV:PYSEC-2024-199...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-47868 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-47868 Source advisory: OSV:PYSEC-2024-217...

aqueduct-llm (0.0.1), fschat (>=0.1.1, <=0.2.15) +3 more potentially affected by CVE-2024-47167 via gradio (3.23.0)

gradio PYPI version 3.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - aqueduct-llm 0.0.1 - fschat =0.1.1, =0.0.1, =0.0.16 Source cves: CVE-2024-47167 Source advisory: OSV:PYSEC-2024-215...