CVE-2024-4897

The CVE-2024-4897 entry affects parisneo/lollms-webui via an insecure dependency on llama-cpp-python (llama_cpp_python-0.2.61+cpuavx2-...), with exploitation possible through the bindings_zoo feature when processing gguf model files. Connected Red Hat CVE-2024-34359 documents explain that the roo...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multi-model system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from the presence of a remote code execution vulnerability that allows an attacker to upload and interact with malicious model files hosted...

Google Is Piloting Face Recognition for Office Security

Plus: A cloud company says notorious Russian hacker group APT29 attacked it, Chinese hackers use ransomware to hide their espionage campaigns, and a bank popular with startups discloses a cyberattack...

AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform

Artificial Intelligence AI company Hugging Face on Friday disclosed that it detected unauthorized access to its Spaces platform earlier this week. "We have suspicions that a subset of Spaces' secrets could have been accessed without authorization," it said in an advisory. Spaces offers a way for...

SUSE CVE-2024-24686

Multiple stack-based buffer overflow vulnerabilities exist in the readOFF functionality of libigl v2.5.0. A specially crafted .off file can lead to stack-based buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.This vulnerability concerns the parsing of commen...

webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents

A use-after-free vulnerability was found in the SVG implementation within WebKitGTK. This flaw allows remote attackers to exploit the removal of an SVGFontFaceElement object, which occurs through specific vectors that trigger the deletion of the object during rendering...

You get a passkey, you get a passkey, everyone should get a passkey

Microsoft is rolling out passkey support for all consumer accounts. Passkeys are a very secure replacement for passwords that cant be cracked, guessed or phished, and let you log in easily, without having to type a password every time. After enabling them in Windows 11 last year, Microsoft accoun...

CVE-2023-41819

A PendingIntent hijacking vulnerability was reported in the Motorola Face Unlock application that could allow a local attacker to access unauthorized content providers...

CVE-2023-41819

The CVE-2023-41819 entry concerns Motorola Face Unlock with a PendingIntent hijacking flaw that could allow a local attacker to access unauthorized content providers. Affected component: Motorola Face Unlock app. Root cause: PendingIntent hijacking vulnerability. Exploitation status is not descri...

Google Announces Passkeys Adopted by Over 400 Million Accounts

Google on Thursday announced that passkeys are being used by over 400 million Google accounts, authenticating users more than 1 billion times over the past two years. "Passkeys are easy to use and phishing resistant, only relying on a fingerprint, face scan or a pin making them 50% faster than...

Motorola Face Unlock 安全漏洞

Motorola Face Unlock is a face unlocking application from Motorola USA. A security vulnerability exists in Motorola Face Unlock that stems from the presence of a hijacking vulnerability that could allow a local attacker to access unauthorized content providers...

PT-2024-12983 · Motorola · Motorola Face Unlock

Name of the Vulnerable Software and Affected Versions: Motorola Face Unlock affected versions not specified Description: A PendingIntent hijacking issue was reported in the Motorola Face Unlock application, allowing a local attacker to access unauthorized content providers. Recommendations: At th...

The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data...

webkitgtk: Processing a file may lead to a denial of service or potentially disclose memory contents

A use-after-free vulnerability was found in the SVG implementation within WebKitGTK. This flaw allows remote attackers to exploit the removal of an SVGFontFaceElement object, which occurs through specific vectors that trigger the deletion of the object during rendering...

The Real-Time Deepfake Romance Scams Have Arrived

Watch how smooth-talking scammers known as “Yahoo Boys” use widely available face-swapping tech to carry out elaborate romance scams...

Hugging Face Transformers 代码问题漏洞

Hugging Face Transformers is advanced natural language processing for Jax, PyTorch and TensorFlow. A code issue vulnerability exists in Hugging Face Transformers that stems from the ease of executing arbitrary code by deserializing untrusted data in the loadrepocheckpoint function of the...

Vulnerabilities Exposed Hugging Face to AI Supply Chain Attacks

By Deeba Ahmed Wiz.io, known for its cloud security expertise, and Hugging Face, a leader in open-source AI tools, are combining their knowledge to develop solutions that address these security concerns. This collaboration signifies a growing focus on securing the foundation of AI advancements...

Wiz Research finds architecture risks that may compromise AI-as-a-Service providers and consequently risk customer data; works with Hugging Face on mitigations

Wiz researchers discovered architecture risks that may compromise AI-as-a-Service providers and put customer data at risk. Wiz and Hugging Face worked together to mitigate the issue...

Yogurt Heist Reveals a Rampant Form of Online Fraud

Plus: “MFA bombing” attacks target Apple users, Israel deploys face recognition tech on Gazans, AI gets trained to spot tent encampments, and OSINT investigators find fugitive Amond Bundy...

CVE-2024-2206

An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the /proxy route. Attackers can exploit this vulnerability by manipulating the self.replicaurls set through the X-Direct-Url header in requests to the / and /config routes, allowing the...