Ruby on Rails: Remote Code Execution

Background Ruby on Rails is a free web framework used to develop database-driven web applications. Description Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact When serialized columns that use YAML the default a...

GHSA-3F6G-M4HR-59H8 OpenFGA Authorization Bypass

Overview OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Fix - If you are using OpenFGA within Docker or as a Go library, as a binary, or through Docker, upgrade to v1.5.9 as soon as possibl...

CVE-2024-42473 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. OpenFGA v1.5.7 and v1.5.8 are vulnerable to authorization bypass when calling Check API with a model that uses but not and from expressions and a userset. Users should downgrade to v1.5.6 as soon as possible. This downgrade is backward compatible. As...

CVE-2023-31315

Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution...

CVE-2023-31315

Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution...

CVE-2023-31315

Improper validation in a model specific register MSR could allow a malicious program with ring0 access to modify SMM configuration while SMI lock is enabled, potentially leading to arbitrary code execution...

Cross Site Scripting (XSS)

openwebui is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to the language model executing arbitrary JavaScript as a result of a maliciously crafted prompt...

Spring AI Embraces OpenAI's Structured Outputs: Enhancing JSON Response Reliability

OpenAI recently introduced a powerful feature called Structured Outputs, which ensures that AI-generated responses adhere strictly to a predefined JSON schema. This feature significantly improves the reliability and usability of AI-generated content in real-world applications. Today, we're excite...

AMD Processors 安全漏洞

AMD Processors is a processor from Ultraviolet Semiconductor AMD. A security vulnerability exists in AMD Processors that stems from incorrect validation in model-specific registers and could allow a malicious program with access privileges to modify the SMM configuration with SMI locking enabled,...

CVE-2024-7557 Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access...

xdp: Remove WARN() from __xdp_reg_mem_model()

...

kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD

In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Keep xfdstate in sync with MSRIA32XFD The Linux kernel CVE team has assigned CVE-2024-35801 to this issue. Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051738-CVE-2024-35801-8038@gregkh/T...

Open WebUI Stored Cross-Site Scripting Vulnerability

Attackers can craft a malicious prompt that coerces the language model into executing arbitrary JavaScript in the context of the web page...

Open WebUI 0.1.105 Persistent Cross Site Scripting

KL-001-2024-005: Open WebUI Stored Cross-Site Scripting Title: Open WebUI Stored Cross-Site Scripting Advisory ID: KL-001-2024-005 Publication Date: 2024.08.06 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt 1. Vulnerability Details Affected Vendor: Open WebUI...

CVE-2024-6706

Open WebUI stores Cross-Site Scripting (XSS) vulnerability CVE-2024-6706 in version 0.1.105 on Debian 12. The issue arises when a malicious prompt coerces the language model into executing arbitrary JavaScript in the context of the web page. Connected advisories (KL-001-2024-005; GHSA-5JP3-WP5V-5...

The vulnerability of Rockwell Automation’s 5015-AENFTXT EtherNet/IP adapter software, related to insufficient validation of input data, allows a intruder to trigger a service failure.

The vulnerability of the microprogramming software for Rockwell Automation’s EtherNet/IP adapters model 5015-AENFTXT lies in insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a service failure by sending specially crafted PTP packets...

Red Hat OpenShift Assisted Installer 访问控制错误漏洞

Red Hat OpenShift Assisted Installer is an assisted boot installer from Red Hat USA. An access control error vulnerability exists in Red Hat OpenShift Assisted Installer that stems from the presence of a cross-model authentication bypass vulnerability...

SUSE CVE-2024-42082

In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN from xdpregmemmodel syzkaller reports a warning in xdpregmemmodel. The warning occurs only if memidinithashtable returns an error. It returns the error in two cases: 1. memory allocation fails; 2. rhashtableinit...

De-risk Generative AI: Enterprise TruRisk Platform Advances to Secure AI and LLM Workloads

As we stand at the frontier of technological innovation, artificial intelligence AI and large language models LLMs are reshaping industries, driving automation, enhancing customer experiences, optimizing processes, and unlocking business opportunities for modern enterprises. However, this rapid...

The vulnerability of D-Link DSL-225 router’s microprogramming software, related to bypassing the authentication process, allows attackers to circumvent the authentication mechanism.

The vulnerability of D-Link DSL-225 router microprogramming software is related to the bypassing of the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent the authentication process...