CVE-2024-5634

Longse model LBH30FE200W cameras, as well as products based on this device, make use of telnet passwords which follow a specific pattern. Once the pattern is known, brute-forcing the password becomes relatively easy. Additionally, every camera with the same firmware version shares the same...

CVE-2024-5633

Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the same local network to an undocumented binary service CoolView on one of the ports. An attacker with a knowledge of the available commands is able to perform...

Improper Handling of Values

Overview Affected versions of this package are vulnerable to Improper Handling of Values. This is because the Permission Model assumes wrongly that any path starting with two backslashes \ has a four-character prefix that can be ignored. Note: This vulnerability affects only Windows users of the...

Cross Site Scripting (XSS)

khoj-assistant is vulnerable to Cross Site Scripting XSS. The vulnerability is due to inadequate sanitization of the AI model's response and user inputs. An attacker can exploit this vulnerability via Prompt Injection from untrusted documents indexed by the user or read from the internet when the...

Internet Bug Bounty: fs.fchown/fchmod bypasses permission model

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. The vulnerability allows operations such as fs.fchown or fs.fchmod to bypass the permission model by using a "read-only" file descriptor to change the owner...

Geomys, a blueprint for a sustainable open source maintenance firm

In 2022, I left Google in search of a sustainable approach to open source maintenance. A year later, I was a full-time independent professional open source maintainer. Today I’m announcing the natural progression of that experiment: Geomys,1 a small firm of professional maintainers with a portfol...

Cross-Site Request Forgery (CSRF)

mudler/localai is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is caused due to insufficient CSRF protection mechanisms on the model deletion functionality, which allows an attackers o trick victims into deleting installed models...

The vulnerability of the Meta Model Repository component of the SAP NetWeaver AS for Java software used for creating and deploying web applications allows a attacker to cause a service failure.

The vulnerability of the Meta Model Repository component in the SAP NetWeaver AS for Java software for creating and deploying web applications is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

The vulnerability of the software environment for simulation modeling of systems and processes in Siemens Tecnomatix Plant Simulation lies in the lack of a mechanism for converting data types, allowing attackers to execute arbitrary code.

The vulnerability of the software environment for simulation modeling of systems and processes in Siemens Tecnomatix Plant Simulation lies in the lack of a mechanism for converting data types. Exploiting this vulnerability allows attackers to execute arbitrary code using a specially created...

Node.js 18.x < 18.20.4 / 20.x < 20.15.1 / 22.x < 22.4.1 Multiple Vulnerabilities (Monday, July 8, 2024 Security Releases).

The version of Node.js installed on the remote host is prior to 18.20.4, 20.15.1, 22.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the Monday, July 8, 2024 Security Releases advisory. - The CVE-2024-27980 was identified as an incomplete fix for the BatBadBut...

CVE-2024-5616

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

CVE-2024-5616

CVE-2024-5616 affects mudler/LocalAI up to version 2.15.0, where the model deletion functionality is vulnerable to CSRF due to insufficient protection. An attacker could lure a user to delete an installed model (e.g., gpt-4-vision-preview) by visiting a malicious page. Affected component: model d...

PT-2024-36727 · Mudler · Localai

Name of the Vulnerable Software and Affected Versions: mudler/LocalAI versions up to and including 2.15.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists, allowing attackers to trick victims into deleting installed models by crafting a malicious HTML page. This can cause the...

LocalAI Security Breach

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A security vulnerability exists in LocalAI version 2.15.0 and prior versions that stems from the presence of a Cross Site Request Forgery CSRF vulnerability. An attacker could use this...

Server Side Request Forgery (SSRF) attack in Fedify

Summary At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the @id or other resources present within the activity it has received from the web. This activity could reference an @id that points to an internal IP address,...

CVE-2024-4897

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llamacpppython-0.2.61+cpuavx2-cp311-cp311-manylinux231x8664. The vulnerability arises from the application's 'bindingzoo' feature, which allows attackers ...

CVE-2024-4897 Remote Code Execution in parisneo/lollms-webui

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llamacpppython-0.2.61+cpuavx2-cp311-cp311-manylinux231x8664. The vulnerability arises from the application's 'bindingzoo' feature, which allows attackers ...

CVE-2024-4897 Remote Code Execution in parisneo/lollms-webui

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llamacpppython-0.2.61+cpuavx2-cp311-cp311-manylinux231x8664. The vulnerability arises from the application's 'bindingzoo' feature, which allows attackers ...