Advisory Catalog

A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function CSMImporter::InternReadFile of the file code/AssetLib/CSM/CSMLoader.cpp. The manipulation leads to heap-based buffer overflow. The attack may be initiated remo

A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function MDLImporter::InternReadFile_Quake1 of the file code/AssetLib/MDL/MDLLoader.cpp. The manipulation of the argument skinwidth/skinheight leads to divide by zero. The at

A vulnerability was found in WebAssembly wabt 1.0.36. It has been declared as critical. This vulnerability affects the function BinaryReaderInterp::GetReturnCallDropKeepCount of the file wabt/src/interp/binary-reader-interp.cc. The manipulation leads to heap-based buffer overflow. The attack can be

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability

vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object

Open WebUI stored cross-site scripting (XSS) vulnerability

Open WebUI allows Remote Code Execution via Arbitrary File Upload to /audio/api/v1/transcriptions

Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read

Open WebUI Allows Viewing of Admin Details

Open WebUI Vulnerable to a Session Fixation Attack

Open WebUI Cross-Site Request Forgery (CSRF) Vulnerability

Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability in api/chat/file

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI has vulnerable dependency on starlette via fastapi

Open WebUI Uncontrolled Resource Consumption vulnerability

Open WebUI Uncontrolled Resource Consumption vulnerability

BentoML Open Redirect vulnerability

BentoML vulnerable to Uncontrolled Resource Consumption

MLflow has Weak Password Requirements

MLflow Cross-Site Request Forgery (CSRF) vulnerability

LiteLLM Has an Improper Authorization Vulnerability

SageMaker Workflow component allows possibility of MD5 hash collisions

MLflow Uncontrolled Resource Consumption vulnerability

LiteLLM Has a Leakage of Langfuse API Keys

A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server b

Aim Excessive Data Query Operations in a Large Data Table vulnerability

Aim Uncontrolled Resource Consumption vulnerability

A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to construct a response link by saving the response in a folder named after the SHA-1 hash of the target URL. This enables the attacker to access the

Kedro deserialization vulnerability

LiteLLM Reveals Portion of API Key via a Logging File

ZenML unauthenticated DoS via Multipart Boundry

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure

An incorrect authorization vulnerability exists in gaizhenbiao/chuanhuchatgpt version git c91dbfc. The vulnerability allows any user to restart the server at will, leading to a complete loss of availability. The issue arises because the function responsible for restarting the server is not properly

A stored cross-site scripting (XSS) vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, affecting version git 20b2e02. The vulnerability arises from improper sanitization of HTML tags in chat history uploads. Specifically, the sanitization logic fails to handle HTML tags within code b

BentoML deserialization vulnerability

BentoML Denial of Service (DoS) via Multipart Boundary

vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Gradio DOS in multipart boundry while uploading the file

composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

Composio Eval Injection Vulnerability

composio Server-Side Request Forgery (SSRF) vulnerability

MLflow has a Local File Read/Path Traversal in dbfs

Aim path traversal in LockManager.release_locks

H2O Vulnerable to Arbitrary File Overwrite

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of other

AgentScope stored cross-site scripting (XSS) vulnerability