ChuanhuChatGPT Information Disclosure Vulnerability

ChuanhuChatGPT provides a fast and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and other LLMs. ChuanhuChatGPT suffers from an information disclosure vulnerability that stems from a timing attack vulnerability in the password comparison logic...

ChuanhuChatGPT Path Traversal Vulnerability

ChuanhuChatGPT provides a fast and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and other LLMs. ChuanhuChatGPT suffers from a path traversal vulnerability that stems from the use of an outdated gradio component that is susceptible to path traversal attacks...

Lunary 访问控制错误漏洞

lunary is a production toolkit for LLM. An access control error vulnerability exists in lunary that stems from insufficient validation of roles and permissions on the backend. An attacker could exploit this vulnerability to cause information disclosure...

ChuanhuChatGPT Access Control Error Vulnerability

ChuanhuChatGPT is a lightweight and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. ChuanhuChatGPT suffers from an access control error vulnerability that stems from an improper access control mechanism...

ALPINE-CVE-2024-5171

Integer overflow in libaom internal function imgallochelper can lead to heap buffer overflow. This function can be reached via 3 callers: Calling aomimgalloc with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and so...

CVE-2024-32871 Pimcore Vulnerable to Flooding Server with Thumbnail files

Pimcore is an Open Source Data & Experience Management Platform. The Pimcore thumbnail generation can be used to flood the server with large files. By changing the file extension or scaling factor of the requested thumbnail, attackers can create files that are much larger in file size than the...

UBUNTU-CVE-2024-5171

Integer overflow in libaom internal function imgallochelper can lead to heap buffer overflow. This function can be reached via 3 callers: Calling aomimgalloc with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and so...

DEBIAN-CVE-2024-5197

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximaget struct may be invalid. Calling...

AZL-42963 CVE-2024-5197 affecting package libvpx 1.13.1-1

There exists interger overflows in libvpx in versions prior to 1.14.1. Calling vpximgalloc with a large value of the dw, dh, or align parameter may result in integer overflows in the calculations of buffer sizes and offsets and some fields of the returned vpximaget struct may be invalid. Calling...

RHEL 6 : qemu-kvm (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - QEMU: net: ignore packets with large size CVE-2018-17963 - Buffer overflow in the sendcontrolmsg function...

The vulnerability of Ollama’s system for running and managing large language models (LLMs) lies in its reliance on reverse DNS resolution for IP addresses. This allows attackers to perform DNS Rebinding attacks or cause service failures.

The vulnerability of Ollama’s system for running and managing large language models is related to the use of reverse DNS resolution for IP addresses. Exploiting this vulnerability could allow a remote attacker to perform a DNS Rebinding attack or cause a service failure...

Regular Expression Denial Of Service (ReDoS)

micromatch is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due a regex expression with inefficient complexity within the micromatch.braces method. An attacker can submit a large payload without a closing bracket, which results in Regular Expression Denial of...

UBUNTU-CVE-2024-36882

In the Linux kernel, the following vulnerability has been resolved: mm: use memallocnofssave in pagecacheraorder See commit f2c817bed58d "mm: use memallocnofssave in readahead path", ensure that pagecacheraorder do not attempt to reclaim file-backed pages too, or it leads to a deadlock, found iss...

PT-2024-40019 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue concerns the handling of online media assets, specifically .youtube and .vimeo files, in the TYPO3 backend. It is vulnerable to a denial of service, which occurs when large files wi...

The vulnerability of the CONNECT component of the Eclipse Mosquitto messaging broker, which allows a hacker to trigger a service failure.

The vulnerability of the CONNECT component of the Eclipse Mosquitto messaging broker is related to the allocation of memory based on an unreliable large value. Exploiting this vulnerability can allow a malicious actor to cause service failures...

[SECURITY] Fedora 40 Update: qt6-qtgraphs-6.7.1-1.fc40

The Qt Graphs module enables you to visualize data in 3D as bar, scatter, and surface graphs. It's especially useful for visualizing depth maps and large quantities of rapidly changing data, such as data received from multiple sensors. The look and feel of graphs can be customized by using themes...

CVE-2024-35238

Summary: Minder by Stacklok (pre-0.0.51) is vulnerable to a DoS caused by the sigstore verifier reading an untrusted response without a size limit. An attacker can cause Minder to fetch attestations from a user-controlled GitHub endpoint (orgs/$owner/attestations/$checksumref) and feed a large re...

Fedora: Security Advisory for rust-cargo-deny (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cyber Signals: Inside the growing risk of gift card fraud

In the ever-evolving landscape of cyberthreats, staying ahead of malicious actors is a constant challenge. Microsoft Threat Intelligence has observed that gift cards are attractive targets for fraud and social engineering practices. Unlike credit or debit cards, there’s no customer name or bank...

CVE-2024-35197

CVE-2024-35197 affects the gitoxide project (gitoxide-core) and related advisories, describing a Windows-specific issue where fetching refs or checking out paths that collide with legacy device names can cause reads from devices or writes to devices. This can lead to indefinite blocking or the pr...