D-Link DSL6740C 安全漏洞

The D-Link DSL6740C is a wireless VDSL router from China-based AUO D-Link. The D-Link DSL6740C suffers from a path traversal vulnerability that stems from the program failing to properly filter special elements in the path of a resource or file. An attacker could exploit this vulnerability to cau...

The vulnerability of the libodx.dll library in the AutoCAD modeling, design, and drawing software allows a perpetrator to cause an unexpected termination of the application or execute arbitrary code.

The vulnerability of the libodx.dll library in AutoCAD simulation, design, and drawing software relates to the reading of data beyond the specified buffer. Exploiting this vulnerability can allow an attacker to cause the application to terminate abnormally or execute arbitrary code using a...

The vulnerability of the Modbus TCP interface of the microprogramming software used in multifunctional measuring instruments for measuring electrical network parameters from Siemens SENTRON 7KM PAC3200 allows a perpetrator to circumvent existing security restrictions and gain unauthorized access to protected information.

The vulnerability of the Modbus TCP interface of Siemens SENTRON 7KM PAC3200 multifunctional measuring instruments for measuring electrical network parameters lies in improper authentication mechanisms. This includes insufficient security measures, such as a weak 4-digit PIN code, and the absence...

The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drafting software allows a perpetrator to gain unauthorized access to protected information, execute arbitrary code, or cause a service failure.

The vulnerability of the libodxdll.dll library in the AutoCAD modeling, design, and drafting software relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information, execute...

CVE-2024-11047

A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been declared as critical. Affected by this vulnerability is the function upgradefilterasp of the file /upgradefilter.asp. The manipulation of the argument path leads to stack-based buffer overflow. The attack can be launched remotely...

Remote Code Execution via Model Deserialization on /api/v2/models/install API

Summary I have identified a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization. The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation. This...

PT-2024-34741 · Unknown · Kendysond Selar.Co Widget

Name of the Vulnerable Software and Affected Versions: Kendysond Selar.Co Widget versions n/a through 1.2 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS vulnerability, allowing DOM-Based XSS. This means...

AI Industry is Trying to Subvert the Definition of “Open Source AI”

The Open Source Initiative has published news article here its definition of "open source AI," and it's terrible. It allows for secret training data and mechanisms. It allows for development to be done in secret. Since for a neural network, the training data is the source code--it's how the model...

Integer Overflow In /v2/repository/models/<model_name>/load

This report is not public...

SUSE CVE-2024-48057

localai =2.20.1 is vulnerable to Cross Site Scripting XSS. When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage...

RHEL 8 : nodejs:20 (RHSA-2024:5814)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5814 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

A malicious gguf model can lead to DoS due to unchecked null pointer dereference via network

This report is not public...

A malicious gguf model can lead to DoS due to unchecked array bound access via network

This report is not public...

malicious gguf model can cause DoS by allocate unlimited memory via network access

This report is not public...

malicious gguf model can be uploaded and created causing division by zero via network, leading to DoS

This report is not public...

DoS using malicious gguf model file

This report is not public...

SUSE CVE-2024-39721

An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely even after the HTTP request is aborted...

python-django: Username enumeration through timing difference for users with unusable passwords

A vulnerability was found in Python-Django in the django.contrib.auth.backends.ModelBackend.authenticate method. This flaw allows remote attackers to enumerate users via a timing attack involving login requests for users with unusable passwords...

CVE-2024-50999

Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request...

[SECURITY] Fedora 40 Update: llama-cpp-b3561-1.fc40

The main goal of llama.cpp is to run the LLaMA model using 4-bit integer quantization on a MacBook Plain C/C++ implementation without dependencies Apple silicon first-class citizen - optimized via ARM NEON, Accelerate and Metal frameworks AVX, AVX2 and AVX512 support for x86 architectures Mixed F...