NVIDIA Triton Inference Server Directory Traversal Vulnerability

NVIDIA Triton Inference Server is an open source software from NVIDIA that helps standardize model deployment and deliver fast and scalable AI in production. NVIDIA Triton Inference Server suffers from a directory traversal vulnerability that stems from when started explicitly with the non-defaul...

IBM Spectrum Virtualize Security Vulnerability

IBM Spectrum Virtualize is a block storage virtualization system from International Business Machines IBM, Inc. that improves the data value, security and simplicity of new and existing storage infrastructures. A security vulnerability exists in IBM Spectrum Virtualize version 8.5 that stems from...

Important: nodejs20

Issue Overview: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x. Please note...

Important: nodejs20

Issue Overview: The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. This misleading documentation affects all users using the experimental permission model in active release lines: 20.x and 21.x. Please note...

Over 100 Malicious AI/ML Models Found on Hugging Face Platform

As many as 100 malicious artificial intelligence AI/machine learning ML models have been discovered in the Hugging Face platform. These include instances where loading a pickle file leads to code execution, software supply chain security firm JFrog said. "The model's payload grants the attacker a...

Phobos Ransomware Aggressively Targeting U.S. Critical Infrastructure

U.S. cybersecurity and intelligence agencies have warned of Phobos ransomware attacks targeting government and critical infrastructure entities, outlining the various tactics and techniques the threat actors have adopted to deploy the file-encrypting malware. "Structured as a ransomware as a...

LangChain directory traversal vulnerability

LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a loadchain call. This bypasses the intended behavior of loading configurations only from the hwchase17/langchain-hub GitHub repository. The outcome can be disclosure...

The vulnerability of the Telnet protocol implementation in D-Link DIR-600M C1 Wi-Fi routers’ microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the Telnet protocol implementation in D-Link DIR-600M C1 Wi-Fi routers is caused by buffer overflow. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SUSE CVE-2021-46940

In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix offset overflow issue in index converting The idxtooffset function returns type int 32-bit signed, but MSRPKGENERGYSTAT is u32 and would be interpreted as a negative number. The end result is that it hi...

SUSE CVE-2021-46977

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disable preemption when probing user return MSRs Disable preemption when probing a user return MSR via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is...

PT-2024-18693 · Sourcecodester · Sourcecodester Computer Inventory System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Inventory System version 1.0 Description: A problem was found in the processing of the file /endpoint/update-computer.php. The manipulation of the model argument leads to cross-site scripting. The attack can be initiat...

LinBle LBT T300-T390 Security Vulnerability

The LinBle LBT T300-T390 is a 4G industrial router from China's LinBle. A security vulnerability exists in the LinBle LBT T300-T390 v2.2.1.8, which is caused by a buffer overflow in the ApCliSsid parameter of the generateconfrouter method...

PT-2024-18691 · Sourcecodester · Sourcecodester Computer Inventory System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Inventory System version 1.0 Description: A problematic issue has been found in the system, affecting the file /endpoint/add-computer.php. The manipulation of the model argument leads to cross-site scripting. This issu...

CVE-2023-51528

Cross-Site Request Forgery CSRF vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4.This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.12...

SUSE SLES15 / openSUSE 15 Security Update : nodejs20 (SUSE-SU-2024:0643-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0643-1 advisory. Update to 20.11.1: security updates CVE-2024-21892: Code injection and privilege escalation through Linux capabilitie...

DEBIAN-CVE-2021-46977

In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Disable preemption when probing user return MSRs Disable preemption when probing a user return MSR via RDSMR/WRMSR. If the MSR holds a different value per logical CPU, the WRMSR could corrupt the host's value if KVM is...

New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks

Cybersecurity researchers have found that it's possible to compromise the Hugging Face Safetensors conversion service to ultimately hijack the models submitted by users and result in supply chain attacks. "It's possible to send malicious pull requests with attacker-controlled data from the Huggin...

The vulnerability of the simulation application for complex systems, Simcenter Femap, related to writing beyond the buffer boundaries, allows a intruder to execute arbitrary code.

The vulnerability of the Simcenter Femap simulation application lies in the ability to write data beyond the buffer boundaries. Exploiting this vulnerability allows an attacker to execute arbitrary code by allowing the user to open a specially crafted Catia MODEL file...

CVE-2024-26468

A DOM based cross-site scripting XSS vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrary Javascript via sending a crafted URL...

llama.cpp Input Validation Error Vulnerability

llama.cpp is a multimodal model by Georgi Gerganov Personal Developer. An input validation error vulnerability exists in llama.cpp, which stems from a specially crafted .gguf file that could lead to code execution...