16956 matches found
Prompt Injection
Vanna is vulnerable to Prompt Injection. The vulnerability is due to improper input validation in the Vanna library's "ask" method, when allowing external input with "visualize" set to True, which allows a user to execute arbitrary python code...
CGA-7VJP-WWVH-H7VR
Bulletin has no description...
DEBIAN-CVE-2023-49441
dnsmasq 2.9 is vulnerable to Integer Overflow via forwardquery...
GHSA-H6M6-JJ8V-94JJ SQL injection in litellm
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...
GHSA-J527-V579-M98H Improper authentication in zenml
An issue was discovered in zenml-io/zenml versions up to and including 0.55.4. Due to improper authentication mechanisms, an attacker with access to an active user session can change the account password without needing to know the current password. This vulnerability allows for unauthorized...
CVE-2024-5131
An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the...
CVE-2024-5126
An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due t...
PYSEC-2024-169
An improper authorization vulnerability exists in the zenml-io/zenml repository, specifically within the API PUT /api/v1/users/id endpoint. This vulnerability allows any authenticated user to modify the information of other users, including changing the active status of user accounts to false,...
CVE-2024-5124 Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt
A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows a...
CVE-2024-2624 Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui
A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the @router.get"/switchpersonalpath" endpoint in ./lollms-webui/lollmscore/lollms/server/endpoints/lollmsuser.py. The vulnerability arises due to insufficient sanitization...
CVE-2024-4941 Local File Inclusion in JSON component in gradio-app/gradio
A local file inclusion vulnerability exists in the JSON component of gradio-app/gradio version 4.25. The vulnerability arises from improper input validation in the postprocess function within gradio/components/jsoncomponent.py, where a user-controlled string is parsed as JSON. If the parsed JSON...
CGA-XR2V-V97H-V4FH
Bulletin has no description...
CGA-XM2P-JP92-PM9H
Bulletin has no description...
CGA-XFGF-QG5M-FFG9
Bulletin has no description...
CGA-X2M6-9947-W8WR
Bulletin has no description...
CGA-WX95-WRVJ-5FXQ
Bulletin has no description...
CGA-WGVJ-8FV5-RRFM
Bulletin has no description...
CGA-WG89-8RGV-4385
Bulletin has no description...