1312430 matches found
Remote Code Execution via Model Deserialization on /api/v2/models/install API
Summary I have identified a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization. The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation. This...
IBM: SQL injection identified on IBM endpoint.
SQL injection vulnerability was identified on an IBM endpoint. The issue was reported to IBM, analyzed, and remediated...
Leakage of Langfuse API keys in team exception handling
This report is not public...
Mars: Customer Data Exposure via Insecure Endpoint of coupon
A security vulnerability was identified in the Royal Canin Greece website. An insecure API endpoint was exposed that allowed unauthorized access to customer information without requiring authentication. The endpoint related to coupon functionality and revealed sensitive customer data, including...
Mars: change part of personal information all users
The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...
Mars: Users Data Exposure via Insecure Endpoint
An insecure endpoint on the Mars Royal Canin website exposed sensitive customer information without proper authentication. Personal data, including full names, phone numbers, email addresses, physical addresses, and postal codes, was accessible through a simple API endpoint that could be accessed...
Integer Overflow In /v2/repository/models/<model_name>/load
This report is not public...
multer(file upload middleware in express) misused, lead to remote code execution
Description Librechat use multer to handle multi-part file upload. multer library will deal with '../' kind of path traversal, then let the programmer decide the actual filename, then join the path to write the upload the file. this means, if '../' is provided by the user of librechat, multer wil...
curl: CVE-2024-11053: netrc + redirect credential leak
CVE-2024-11053 was a logic flaw in Curl that resulted in a credential leak during redirects. The issue was caused by the way Curl processed netrc credentials when performing redirects. Under certain conditions, the redirect passed along credentials specified for the original host to the redirecti...
Mars: unauthorized access and add user and change personal information all users
The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...
Localize: open redirected by host header
An Open Redirect vulnerability occurs when an application allows users to be redirected to an external, untrusted URL without validating the redirection target. By controlling the Host header and observing a redirection to the specified external site, you may have found an open redirect...
IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint Allows Unauthorized Score Updates for Other Users’ Runs
Description An Insecure Direct Object Reference IDOR vulnerability exists in the PATCH /v1/runs/:id/score endpoint. This endpoint allows an attacker to update the score data of any run by manipulating the id parameter in the request URL, which corresponds to the runIdscore in the database. The...
RCE via Global State Override
This exploit effectively serves as a bypass for CVE-2024-3408. An attacker can override global state to enable custom filters, which then facilitates remote code execution RCE. Specifically, this vulnerability leverages the ability to manipulate global application settings to activate the...
Internet Bug Bounty: Apache Airflow: Sensitive Information Exposure in DAG Run Logs
The Apache Airflow platform was vulnerable to sensitive information exposure in DAG run logs. Passwords, secrets, and the Fernet key were logged in plain text, which could have resulted in the disclosure of this sensitive information to unauthorized users...
Internet Bug Bounty: Secrets not masked in UI when sensitive variables are set via Airflow cli
A vulnerability was discovered in Apache Airflow where sensitive variables set using the Airflow CLI were not properly masked in the UI, specifically in the Audit logs page. This issue was addressed in the 2.10.3 release of Apache Airflow...
A malicious gguf model can lead to DoS due to unchecked null pointer dereference via network
This report is not public...
A malicious gguf model can lead to DoS due to unchecked array bound access via network
This report is not public...
malicious gguf model can cause DoS by allocate unlimited memory via network access
This report is not public...