Linux Distros Unpatched Vulnerability : CVE-2022-25758

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service ReDoS via the loadAnnotation function, due to the usage of insecur...

Linux Distros Unpatched Vulnerability : CVE-2017-12595

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The tokenizer in QPDF 6.0.0 and 7.0.b1 is recursive for arrays and dictionaries, which allows remote attackers to cause a denial of service stack consumption an...

PT-2025-16804

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. This can result in such tags being marked as self-closing when...

Deserialization of Untrusted Data

Overview chattts is an A generative speech model for daily dialogue Affected versions of this package are vulnerable to Deserialization of Untrusted Data when loading the tokenizer with torch.load. An attacker can exploit this by supplying a malicious tokenizer.pt file, leading to code execution...

WS-2023-0258

Authorized clients in Tokenizer, having an injectprocessor secret, could brute-force the secret token value by abusing the fmt parameter to the Proxy-Tokenizer header...

PT-2024-40623 · Git +1 · Llama.Cpp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state includes functions such as llama output reserve and llama decode, and is located in...

llamacpp:fuzz_tokenizer_command_r: Crash in llama_output_reserve

Detailed Report: https://oss-fuzz.com/testcase?key=6195577928351744 Project: llamacpp Fuzzing Engine: libFuzzer Fuzz Target: fuzztokenizercommandr Job Type: libfuzzerubsanllamacpp Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffdf8 Crash State: llamaoutputreserve...

PT-2024-40620 · Git +1 · Llama.Cpp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A crash occurred due to a segmentation fault on an unknown address. The crash state includes functions such as llama output reserve and llama decode, whi...

Malicious code in css-tokenizer (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9577 Malicious code in css-tokenizer (npm)

--- -= Per source details. Do not edit below this line.=-...

cpython3:fuzz_pycompile: Use-of-uninitialized-value in _PyTokenizer_translate_newlines

Project: https://github.com/python/cpython.git Detailed Report: https://oss-fuzz.com/testcase?key=5129746917163008 Project: cpython3 Fuzzing Engine: libFuzzer Fuzz Target: fuzzpycompile Job Type: libfuzzermsancpython3 Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash...

RHEL 8 : grafana (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - nodejs-underscore: Arbitrary code execution via the template function CVE-2021-23358 - node-fetch is...

UBUNTU-CVE-2024-39705

NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averagedperceptrontagger and punkt...

Server-side Template Injection (SSTI)

litellm is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to insufficient sanitization within the hfchattemplate method in factory.py, which processes the chattemplate parameter from the tokenizerconfig.json file using the Jinja template engine, allowing attackers to...

GHSA-46CM-PFWV-CGF8 LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint

BerriAI/litellm is vulnerable to Server-Side Template Injection SSTI via the /completions endpoint. The vulnerability arises from the hfchattemplate method processing the chattemplate parameter from the tokenizerconfig.json file through the Jinja template engine without proper sanitization...

PT-2024-22934

Name of the Vulnerable Software and Affected Versions BerriAI/litellm affected versions not specified Description The issue arises from the hf chat template method processing the chat template parameter from the tokenizer config.json file through the Jinja template engine without proper...

PT-2023-32836 · Hugging Face · Transformers

Name of the Vulnerable Software and Affected Versions: huggingface/transformers versions prior to 4.36 Description: The issue concerns the deserialization of untrusted data, which can compromise model integrity and potentially lead to remote code execution RCE. This is particularly relevant when...

pigweed:detokenize_fuzzer: Use-of-uninitialized-value in pw::tokenizer::Detokenizer::Detokenize

Detailed Report: https://oss-fuzz.com/testcase?key=4827947886051328 Project: pigweed Fuzzing Engine: libFuzzer Fuzz Target: detokenizefuzzer Job Type: libfuzzermsanpigweed Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: pw::tokenizer::Detokenizer::Detokenize...

GO-2023-1914 Brute-force of token secrets in github.com/superfly/tokenizer

Brute-force of token secrets in github.com/superfly/tokenizer...

Brute Force Token Secrets

superfly/tokenizer is vulnerable to brute-force of token secrets vulnerability. The vulnerability is due to not restricting formatting in fmt parameter to simple formatting and allowing fmt/dst parameters to be specified at request time leading to attacker brute forcing secret values using...