CVE-2024-8966

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service DoS attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue...

CVE-2024-8183

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

CVE-2024-8018

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service DOS attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible...

CVE-2024-8183 CORS Misconfiguration in prefecthq/prefect

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

CVE-2024-8183

CVE-2024-8183 affects the Prefect framework (prefect, v2.20.2). The issue is a misconfigured Cross-Origin Resource Sharing (CORS) policy that permits unauthorized domains to access sensitive data, potentially enabling unauthorized access to the database and leading to data leaks, confidentiality ...

CVE-2024-8183 CORS Misconfiguration in prefecthq/prefect

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

CVE-2024-8966 Denial of Service in gradio-app/gradio

A vulnerability in the file upload process of gradio-app/gradio version @gradio/[email protected] allows for a Denial of Service DoS attack. An attacker can append a large number of characters to the end of a multipart boundary, causing the system to continuously process each character and issue...

CVE-2024-8966

The CVE concerns a DoS in the file upload path of gradio-app/gradio, specifically @gradio/[email protected]. An attacker can append a large number of characters to the end of a multipart boundary, causing the server to process each character and generate warnings, which can render Gradio inaccessible ...

CVE-2024-9365

CVE-2024-9365 describes a Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon v2.4.0 . The vulnerability enables attackers to perform unauthorized actions in the victim’s browser context, including creating projects, model versions, and artifact versions, or changing settings, with potential d...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2024-9229

CVE-2024-9229 affects the Quivr project (stangirard/quivr) v0.0.298, with a DoS caused by unauthenticated attackers who append characters to the end of a multipart boundary during file uploads. The vulnerability triggers continuous processing per character, leading to high resource consumption an...

CVE-2024-8018 Denial of Service (DOS) in imartinez/privategpt

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service DOS attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible...

CVE-2024-8018 Denial of Service (DOS) in imartinez/privategpt

A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service DOS attack. When uploading a file, if an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process these characters, rendering privateGPT inaccessible...

CVE-2024-9363 Unauthorized File Deletion in polyaxon/polyaxon

An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as polyaxon.sock, causing the API container to exit...

CVE-2024-9363 Unauthorized File Deletion in polyaxon/polyaxon

An unauthorized file deletion vulnerability exists in the latest version of the Polyaxon platform, which can lead to denial of service by terminating critical containers. An attacker can delete important files within the containers, such as polyaxon.sock, causing the API container to exit...

CVE-2025-0188 SSRF in gaizhenbiao/chuanhuchatgpt

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

CVE-2025-0188 SSRF in gaizhenbiao/chuanhuchatgpt

A Server-Side Request Forgery SSRF vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access th...

CVE-2025-0188

CVE-2025-0188 concerns a Server-Side Request Forgery (SSRF) in the project gaizhenbiao/chuanhuchatgpt, version 20240914. The described flaw allows an attacker to craft a response link by saving content to a folder named after the SHA-1 hash of the target URL, which can enable direct access to the...

Improper Handling of Exceptional Conditions

Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the streamcomplete method of the LangChainLLM class. An attacker can disrupt service availability by providing an input of type...