Unveiling the Landscape of LLM Deployment in the Wild: an Empirical Study

Background: Large language models LLMs are increasingly deployed via open-source and commercial frameworks, enabling individuals and organizations to self-host advanced AI capabilities. However, insecure defaults and misconfigurations often expose LLM services to the public Internet, posing...

Mozilla: External protocol handlers leaked by timing attack

The Mozilla Foundation Security Advisory describes this flaw as: By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system...

CVE-2023-48225 Laf env causes sensitive information disclosure

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

OpenHarmony has an unspecified vulnerability (CNVD-2023-91563)

OpenHarmony is a kind of hongmeng operating system open source project. A security vulnerability exists in OpenHarmony before version v3.2.2, which can be exploited by attackers to cause system information leakage...

UBUNTU-CVE-2023-25750

Under certain circumstances, a ServiceWorker's offline cache may have leaked to the file system when using private browsing mode. This vulnerability affects Firefox 111...

Security Vulnerabilities fixed in Firefox 111 — Mozilla

The fullscreen notification could have been hidden on Firefox for Android by using download popups, resulting in potential user confusion or spoofing attacks. This bug only affects Firefox for Android. Other operating systems are unaffected. By displaying a prompt with a long description, the...

File Containment Vulnerability in Beijing PaiNet Software Traffic Analysis Management System

Beijing Paiwang Software Co., Ltd. is specialized in the development of domestic web application layer traffic monitoring and management engine. A file inclusion vulnerability exists in the traffic analysis management system of Beijing Pai Networks Software. The vulnerability allows attackers to...