5429 matches found
CVE-2024-1741 Improper Authorization in lunary-ai/lunary
lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by...
CVE-2024-1741
CVE-2024-1741 affects lunary-ai/lunary v1.0.1, with an improper authorization flaw enabling removed members to read, create, modify, and delete prompt templates by reusing an old authorization token. The issue allows operations on prompt templates despite removal from an organization, via HTTP re...
CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
CVE-2024-3098
A vulnerability was identified in the "executils" class of the "llamaindex" package, specifically within the "safeeval" function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
WildFly Elytron: OIDC app attempting to access the second tenant, the user should be prompted to log
A flaw was found in JBoss EAP. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if...
Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included
Microsoft has released security updates for the month of April 2024 to remediate a record 149 flaws, two of which have come under active exploitation in the wild. Of the 149 flaws, three are rated Critical, 142 are rated Important, three are rated Moderate, and one is rated Low in severity. The...
CVE-2023-6236
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...
CVE-2023-6236 Eap: oidc app attempting to access the second tenant, the user should be prompted to log
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...
CVE-2023-6236 Eap: oidc app attempting to access the second tenant, the user should be prompted to log
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in...
LlamaIndex 代码注入漏洞
LlamaIndex is a data framework for an LLM application by the individual developer Jerry Liu. A code injection vulnerability exists in LlamaIndex that stems from insufficient input validation of the safeeval function in executils, which allows injection at the prompt, leading to arbitrary code...
CVE-2024-3098: Improper Control of Generation of Code
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
WordPress Geo Controller < 8.6.5 - PHP Object Injection
Description The plugin unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog...
PT-2024-18266 · Lunary Ai · Lunary
Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.0.1 Description: The issue allows removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform...
CVE-2024-1741: Incorrect Authorization
lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by...
PT-2024-23701
Name of the Vulnerable Software and Affected Versions llama index package affected versions not specified Description A vulnerability was identified in the exec utils class of the llama index package, specifically within the safe eval function, allowing for prompt injection leading to arbitrary...
CVE-2024-29988
SmartScreen Prompt Security Feature Bypass Vulnerability...