EUVD-2024-32707

Malicious code in bioql PyPI...

EUVD-2024-22955

Malicious code in bioql PyPI...

How to deploy AI safely

In this blog you will hear directly from Corporate Vice President and Deputy Chief Information Security Officer CISO for AI, Yonatan Zunger, about how to build a plan to deploy AI safely. This blog is part of a new ongoing series where our Deputy CISOs share their thoughts on what is most importa...

CVE-2024-11043 Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeai

A Denial of Service DoS vulnerability was discovered in the /api/v1/boards/boardid endpoint of invoke-ai/invokeai version v5.0.2. This vulnerability occurs when an excessively large payload is sent in the boardname field during a PATCH request. By sending a large payload, the UI becomes...

AI and Civil Service Purges

Donald Trump and Elon Musk's chaotic approach to reform is upending government operations. Critical functions have been halted, tens of thousands of federal staffers are being encouraged to resign, and congressional mandates are being disregarded. The next phase: The Department of Government...

CVE-2024-1625

An Insecure Direct Object Reference IDOR vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails t...

The vulnerability of the AI application scaling framework and Python Ray, related to deficiencies in the authentication process, allows attackers to read arbitrary files from the /static/ directory.

The vulnerability of the AI application scaling framework and Python Ray is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to read arbitrary files from the /static/ directory using a specially crafted HTTP request...

The vulnerability of the AI application scaling framework and Python Ray, related to an incorrect path name limitation for the restricted access catalog, allows attackers to read arbitrary files.

The vulnerability of the AI application scaling framework and Python Ray is related to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability allows a malicious actor to read arbitrary files using the “filename” parameter...