13641 matches found
Social Media Accounts: The Weak Link in Organizational SaaS Security
Social media accounts help shape a brand's identity and reputation. These public forums engage directly with customers as they are a hub to connect, share content and answer questions. However, despite the high profile role these accounts have, many organizations overlook social media account...
PT-2024-38040
Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description An information disclosure issue exists related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different err...
PT-2024-8880 · Ibm · Ibm Engineering Systems Design Rhapsody - Model Manager
Name of the Vulnerable Software and Affected Versions: IBM Engineering Systems Design Rhapsody - Model Manager versions 7.0.2 through 7.0.3 Description: The issue is caused by a race condition, allowing a remote attacker to bypass security restrictions. By sending a specially crafted request, an...
D-Link DIR-619 安全漏洞
The D-Link DIR-619L is a wireless router designed for home and small office environments, utilizing the IEEE 802.11n standard with a maximum transmission rate of 300Mbps. The D-Link DIR-619L suffers from a buffer overflow vulnerability that originates from the curTime parameter of the...
hw: amd: SMM Lock Bypass
A flaw was found in hw. Improper validation in a model-specific register MSR could allow a malicious program with ring0 access to modify the SMM configuration while the SMI lock is enabled. This issue can lead to arbitrary code execution...
The vulnerability of the exportOvpn() function in TOTOLINK AC1200 T8 router microprogramming software allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the exportOvpn function in TOTOLINK AC1200 T8 router microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...
Arbitrary Code Execution
Overview sentence-transformers is a State-of-the-Art Text Embeddings Affected versions of this package are vulnerable to Arbitrary Code Execution when loading PyTorch model files. The torch.load function, used without the weightsonly=True parameter, could deserialize malicious Python objects from...
DEBIAN-CVE-2024-46856
In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices The probe function is only used for DP83822 and DP83826 PHY, leaving the private data pointer uninitialized for the DP83825 models which causes a NULL pointer...
WordPress AI Chatbot with ChatGPT by AYS plugin <= 2.0.9 - Unauthenticated OpenAI Key Disclosure vulnerability
Unauthenticated OpenAI Key Disclosure vulnerability discovered by Kieran Burge in WordPress Plugin AI ChatBot with ChatGPT and Content Generator by AYS versions = 2.0.9...
WordPress Absolute Reviews plugin <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name vulnerability
Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via Criteria Name vulnerability discovered by Muhammad Adel ItsFadinG in WordPress Plugin Absolute Reviews versions = 1.1.3...
PT-2024-7246 · D Link · D-Link Dir-605L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: A critical issue has been found in the function formSetEasy Wizard of the file /goform/formSetEasy Wizard. The manipulation of the argument curTime leads to buffer overflow. This can be...
CGA-G59M-4P34-CJ7J
Bulletin has no description...
MAL-2024-8975 Malicious code in test-object-model (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a8444231c11ecbd30418a30d5b3805f87015c6ca2683784be6685ef4c77c25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in test-object-model (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19a8444231c11ecbd30418a30d5b3805f87015c6ca2683784be6685ef4c77c25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-28848 · Doccano · Doccano
Name of the Vulnerable Software and Affected Versions: Doccano Open source annotation tools for machine learning practitioners version 1.8.4 Doccano Auto Labeling Pipeline module to annotate a document automatically version 0.1.23 Description: The issue allows a remote attacker to escalate...
Doccano 安全漏洞
doccano is an open source human text annotation tool from doccano open source. A security vulnerability exists in Doccano v1.8.4 and earlier versions. A remote attacker exploited the vulnerability to elevate privileges via the modelattribs parameter...
OSV-2024-1090 UNKNOWN READ in ggml_free
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538517 Crash type: UNKNOWN READ Crash state: ggmlfree llamamodel::llamamodel llamaloadmodelfromfile...
GHSA-WC36-9694-F9RF vLLM Denial of Service via the best_of parameter
A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...
vLLM Denial of Service via the best_of parameter
A vulnerability was found in the ilab model serve component, where improper handling of the bestof parameter in the vllm JSON web API can lead to a Denial of Service DoS. The API used for LLM-based sentence or chat completion accepts a bestof parameter to return the best completion from several...