CVE-2024-7783: Cleartext Storage of Sensitive Information

mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT JSON Web Token used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of...

Watermark for LLM-Generated Text

Researchers at Google have developed a watermark for LLM-generated text. The basics are pretty obvious: the LLM chooses between tokens partly based on a cryptographic key, and someone with knowledge of the key can detect those choices. What makes this hard is 1 how much text is required for the...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

RAGFlow 命令注入漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A command injection vulnerability exists in RAGFlow version 0.11.0, which stems from a lack of comprehensive input validation or cleanup, causing the addllm function in llmapp.py to contain a...

PT-2024-10269 · Unknown · Llm Lunary

Name of the Vulnerable Software and Affected Versions: LLM Lunary affected versions not specified Description: The issue is related to insufficient access control mechanisms in the LLM Lunary platform, which is used for monitoring, managing, and improving applications. This can be exploited by a...

PT-2024-16051 · Infiniflow · Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version 0.11.0 Description: The issue concerns a remote code execution vulnerability in the add llm function, located in llm app.py. This function utilizes user-supplied input, specifically req'llm factory' and req'llm name...

AI/LLM Claude Sonnet API Detection

Binary data 701487.prm...

AI/LLM Google Gemini API Detection

Binary data 701488.prm...

AI/LLM Matroid AI Detection

Binary data 701484.prm...

AI/LLM Bettybot Domain Detection

Binary data 701483.prm...

AI/LLM Clarifai Detection

Binary data 701485.prm...

AI/LLM IBM watsonx Detection

Binary data 701486.prm...

GHSA-WC36-9694-F9RF vLLM Denial of Service via the best_of parameter

A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...

AI/LLM Read.AI Detection

Binary data 701480.prm...

Malicious code in mlc-llm-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bdf6d47b319cb60e32a6f2942beaa54bfe6ccc01bb72a8337f062746d49ace38 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

This Week in Spring - August 27th, 2024 - SpringOne 2024 edition

Hi, Spring fans, from the expo hall of SpringOne at VMware Explore 2024! There's a livestream of some of the key talks - register and watch for free now at SpringOne.io. Right now I'm hanging out at the expo hall manning a booth and doing demos to the hoardes of people streaming by, but I'll be...

VulnCheck KEV: CVE-2024-6587

LiteLLM is vulnerable to a Server-Side Request Forgery SSRF vulnerability that exposes OpenAI API Keys...

Spring AI with NVIDIA LLM API

Spring AI now supports NVIDIA's Large Language Model API, offering integration with a wide range of models. By leveraging NVIDIA's OpenAI-compatible API, Spring AI allows developers to use NVIDIA's LLMs through the familiar Spring AI API. We'll explore how to configure and use the Spring AI OpenA...

CVE-2024-3104

creationtimestamp| type| source ---|---|--- 2024-08-14 16:35:18+00:00| published-proof-of-concept| https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/anythingllmcve20243104...

CVE-2024-42478

llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpctensor structure can cause arbitrary address reading. This vulnerability is fixed in b3561...