Advisory Catalog

Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the username is provided via an HTTP request from the client side, rather than being read from a secure

BentoML Denial of Service (DoS) via Multipart Boundary

LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request

Gradio DOS in multipart boundry while uploading the file

composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL

composio Server-Side Request Forgery (SSRF) vulnerability

MLflow has a Local File Read/Path Traversal in dbfs

H2O Vulnerable to Arbitrary File Overwrite

A vulnerability in gaizhenbiao/chuanhuchatgpt version 20240802 allows attackers to access, copy, and delete other users' chat histories. This issue arises due to improper handling of session data and lack of access control mechanisms, enabling attackers to view and manipulate chat histories of other

AgentScope directory traversal vulnerability in /read-examples

AgentScope arbitrary file download vulnerability in rpc_agent_client

AgentScope Path Traversal in /api/file

Aim Improper Access Control

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted type for `block_count` in the Modelfile. This can lead to a denial of service (DoS) condition when the server processes the model, causing it to crash.

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

Aim allows denial of service due to no timeouts for some tracking server endpoints

Open WebUI lacks authentication for the `api/v1/utils/pdf` endpoint

PyTorch Lightning denial of service vulnerability

Open WebUI denial of service through endpoint for converting markdown

H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload

Open WebUI Allows Arbitrary File Reading and Deletion

LoLLMS Code Injection vulnerability

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

H2O Vulnerable to Arbitrary File Overwrite via File Export

Aim Path Traversal vulnerability

Gunicorn HTTP Request/Response Smuggling vulnerability

LiteLLM Vulnerable to Remote Code Execution (RCE)

LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions

Aim Uncontrolled Resource Consumption vulnerability

imaginAIry Denial of Service (DoS) vulnerability

Transformers Regular Expression Denial of Service (ReDoS) vulnerability

LlamaIndex Improper Handling of Exceptional Conditions vulnerability

FastChat Server-Side Request Forgery vulnerability

GluonCV Arbitrary File Write via TarSlip

Kedro allows Remote Code Execution by Pulling Micro Packages

FastChat Server-Side Request Forgery vulnerability

Feast Cross-Origin Resource Sharing vulnerability

InvokeAI Uncontrolled Resource Consumption vulnerability

FastChat Denial of Service vulnerability

FastChat Uncontrolled Resource Consumption vulnerability

DB-GPT vulnerable to Cross-Site Request Forgery

DB-GPT Path Traversal vulnerability

DB-GPT Uncontrolled Resource Consumption vulnerability

InvokeAI has Denial of Service (DoS) vulnerability in `/api/v1/images/upload`

HyperLPR Denial of Service vulnerability

An unauthenticated Denial of Service (DoS) vulnerability was identified in ChuanhuChatGPT version 20240918, which could be exploited by sending large data payloads using a multipart boundary. Although a patch was applied for CVE-2024-7807, the issue can still be exploited by sending data in groups w