Arbitrary file deletion in litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

CVE-2024-3234

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-4888 Arbitrary File Deletion in BerriAI/litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

CVE-2024-4890

The CVE-2024-4890 entry applies to the berriai/litellm project. A blind SQL injection exists in the /team/update flow due to improper handling of the user_id parameter in the raw SQL used to delete users, with affected version 1.27.14. Exploitation could yield unauthorized access to sensitive dat...

CVE-2024-4890 Blind SQL Injection in berriai/litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-37364

Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensitive information such as hotel invoice content with PII, and potentially create unauthorized room keys, by entering a guest-search quote character and then...

CGA-XPJJ-HV4W-94C5

Bulletin has no description...

CGA-W5QF-G36X-38H2

Bulletin has no description...

CGA-JMP8-CWQ9-QP36

Bulletin has no description...

PT-2024-33255

Name of the Vulnerable Software and Affected Versions BerriAI's litellm version latest Description The issue arises from improper input validation on the "/audio/transcriptions" endpoint, allowing an attacker to send a specially crafted request that includes a file path to the server. This result...

PT-2024-27501 · Microsoft +1 · Windows Os +1

Name of the Vulnerable Software and Affected Versions: Ariane Allegro Scenario Player through 2024-03-05 Description: The issue allows physically proximate attackers to obtain sensitive information, such as hotel invoice content with personally identifiable information PII, and potentially create...

PT-2024-11906 · Wireguard +4 · Wireguard +4

Name of the Vulnerable Software and Affected Versions: netplan versions prior to 1.0 Description: The issue concerns netplan leaking the private key of WireGuard to local users. A security fix is expected to be released soon. Recommendations: For versions prior to 1.0, a security fix will be...

PT-2024-33259

Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.27.14 Description A blind SQL injection issue exists in the application, specifically within the "/team/update" process. This issue arises due to the improper handling of the user id parameter in the raw SQL query use...

SUSE CVE-2022-22934

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion's public key, which can result in attackers substituting arbitrary pillar data...

MAL-2024-1533 Malicious code in glup-debugger-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5001b44290fb031aa2d19602d8706fe384823c3fd0a2a02dedb3bab957d93f07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-HUBBLE-2023-29002

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

MAL-2024-1527 Malicious code in win66lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ef7e6b9c91af7d4a4e2199453260e026047e3029e2d8cc795fd530f1e6e1e8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...