Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2024-9308

Open Redirect in haotian-liu/llava

An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hliu
Products
Llava
CVE-2024-12065

Local File Inclusion in haotian-liu/llava

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04. This vulnerability allows an attacker to access any file on the system by sending multiple crafted requests to the server. The issue is due to improper input validation in the gradio web UI component.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hliu
Products
Llava
CVE-2024-12068

Server-Side Request Forgery in haotian-liu/llava

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04. This vulnerability allows an attacker to make the server perform HTTP requests to arbitrary URLs, potentially accessing sensitive data that is only accessible from the server, such as AWS metadata credentials.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hliu
Products
Llava
CVE-2024-10225

Denial of Service in haotian-liu/llava

A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application inaccessible.

CVSS 3.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Hliu
Products
Llava
CVE-2024-9309

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

CVSS 3.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Hliu
Products
Llava