Malicious code in byted-midas-render-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b801b5ca095df1e96b38bfc8f414ed583b82378f669eea2e6028157e2dbecc94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Planning Analytics Workspace is affected by vulnerabilities

Summary There are vulnerabilities in multiple Open Source Software OSS components consumed by IBM Planning Analytics Workspace. For more information about the vulnerability impact, refer to the table in the "Related Information" section. This Security Bulletin relates only to the direct usage of...

Denial of Service (DoS)

Overview dbgpt is a DB-GPT is an experimental open-source project that uses localized GPT large models to interact with your data and environment. With this solution, you can beassured that there is no risk of data leakage, and your data is 100% private and secure. Affected versions of this packa...

dify 代码问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.1 of dify, which stems from an unvalidated URL and could lead to a server-side request forgery attack...

Danswer 资源管理错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. Danswer suffers from a Resource Management Error vulnerability that stems from a regular expression denial of service, which could result in significantly slower...

RAGFlow 安全漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A security vulnerability exists in RAGFlow version 0.12.0 that originates from an unvalidated URL and could lead to a server-side request forgery attack...

Lunary 安全漏洞

lunary is lunary open source a production toolkit for LLM . An access control error vulnerability exists in lunary that stems from improper access control on the /prompts/promptid endpoint, and no detailed vulnerability details are provided at this time...

Lunary 授权问题漏洞

lunary is lunary open source a production toolkit for LLM . An authorization issue vulnerability exists in lunary that stems from /bigquery API routing without proper access control, no detailed vulnerability details are provided at this time...

dify 安全特征问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security feature issue vulnerability exists in dify version v0.10.1 that stems from a weak pseudo-random number generator that could lead to account takeover...

AutoGPT 代码问题漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to make accessible AI available and buildable for everyone. A code issue vulnerability exists in versions prior to AutoGPT v0.4.0 that stems from a server-side request forgery vulnerability in the Requests tool that could lead to an SSRF attack...

Quivr 安全漏洞

Quivr is an artificial intelligence application open-sourced by Quivr. A security vulnerability exists in Quivr that stems from a path traversal that allows an attacker to upload a file to an arbitrary path in an S3 bucket...

Danswer 访问控制错误漏洞

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. An access control error vulnerability exists in Danswer version v0.3.94 that stems from the application not validating the file creator, which could allow an attacke...

编号撤回

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...

Lunary 安全漏洞

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary versions prior to 1.5.9, which stems from a security issue in /v1/evaluators/endpoints, and can be exploited by an attacker to delete evaluator data, resulting in permanent data loss and potentia...

H2O 安全漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A security vulnerability exists in H2O version 3.46.0, which stems from a custom encryption tool endpoint that does not restrict encrypted files, potentially leading to ransomware behavior...

AutoGPT 代码问题漏洞

AutoGPT is a tool from AutoGPT Open Source. Used to enable everyone to use and build accessible AI. AutoGPT agpt-platform-beta-v0.1.1 version has a code issue vulnerability that stems from multiple SSRF vulnerabilities that could lead to credential disclosure and internal network scanning...

H2O 代码问题漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A code issue vulnerability exists in H2O version 3.46.0.4, which stems from deserializing untrusted data and could lead to remote code execution...

RAGFlow 授权问题漏洞

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. An authorization issue vulnerability exists in RAGFlow version 0.13.0, which stems from not handling tenant IDs correctly and could lead to partial account takeover...

编号撤回

LocalAI is a free, open-source alternative to OpenAI by the individual developer Ettore Di Giacinto. This CVE number has been withdrawn...

polyaxon 跨站请求伪造漏洞

polyaxon is a polyaxon open source MLOps tool for managing and orchestrating the machine learning lifecycle. A cross-site request forgery vulnerability exists in polyaxon version v2.4.0, which stems from cross-site request forgery and could lead to unauthorized operations...