Dem0000000

A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding LM.load of the file farm/modeling/language model.py of the component Model Package Loader. The manipulation of the argument embeddings filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.

A path traversal issue exists in the Convertor component within the `load model()` function of the `pymllm/mobile/convertor/ init .py` file. A local attacker can manipulate the `shard file` argument to access files outside the intended directory. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables that reference files with input that is not properly validated.

A remote path traversal issue exists in the `validate indexed tensors()` function within the qwen-mtp-gguf/scripts/qwen mtp gguf pipeline.py file. This occurs when the `weight map` argument is manipulated, allowing an attacker to access files or directories outside the intended folder.

A path traversal issue exists in the MTP weight map Handler component within the `extract mtp heads()` function of the `qwen-mtp-gguf/scripts/qwen mtp gguf pipeline.py` file. A remote attacker can exploit this by manipulating the `shard name` argument to access files or directories outside the intended folder.

A path traversal issue exists in the `load hf state dict filtered()` function within the `models/tt transformers/tt/load checkpoints.py` file. This occurs when the `weight map` argument is manipulated, allowing a remote attacker to potentially access or traverse unauthorized directories.

Remote path traversal is possible within the Model Package Metadata Handler component. The issue exists in the `DLModelManager.get model meta()` function located in the `berrynet/dlmodelmgr.py` file, where improper handling of the `label` argument allows an attacker to access files outside the intended directory.

A flaw in the Config Reference Resolver component allows for remote code injection. The issue resides in the `resolve()` function within the `deeppavlov/core/common/params.py` file.

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Code injection is possible via remote attack within the Condition Expression Pipeline component. The issue exists in the `Evaluator.walkFunction()` function located in the `packages/evaluator/src/evaluator.js` file, where manipulation of the `condition` argument allows for the execution of arbitrary code.

Remote code injection is possible through the manipulation of the `preprocessor` argument within the `MultiTaskPipelinePreprocessor. init ()` function located in the deeppavlov/models/preprocessors/multitask preprocessor.py file.

A buffer overflow occurs during string parsing when the `len` argument is manipulated. This issue is located within the `GGUFBuffer::ReadString()` function in the `third party/gguf/gguf.cpp` file and can be triggered remotely.

Remote code injection is possible through the manipulation of the `model lib` argument within the ` get lib module()` function located in the python/mlc chat/chat module.py file.

An issue exists in the Pyannote Diarization Model Loading component within the function `PyannoteDiarizationModelManager. load fn` located in the file `src/speaches/executors/pyannote diarization.py`. Manipulation of the `model` argument allows an attacker to use externally-controlled input to select classes or code, which can be triggered remotely.

A buffer overflow occurs in the Eh Frame Section Handler component within the ` bfd elf write section eh frame()` function of the `bfd/elf-eh-frame.c` file. This issue is triggered by the manipulation of the `cie length`, `fde length`, `augmentation data size`, or `write offset` arguments. Local access is required to exploit this flaw.

A flaw exists in the MP4Box component within the `gf node get field count()` function of the `scenegraph/base scenegraph.c` file. A local attacker can perform a manipulation that triggers a reachable assertion, which is a check used during development to ensure the program state is valid, and if it fails, the program terminates.

A flaw exists in the MP4Box component within the `lsr exec command list()` function of the `laser/lsr dec.c` file. Local access is required to exploit this issue, where manipulation of the function leads to a reachable assertion, potentially causing the application to crash.

A buffer overflow occurs in the ld component within the `cache bwrite()` function of the bfd/cache.c file. This issue is triggered by the manipulation of the `nbytes` argument and requires local access to exploit.

A null pointer dereference occurs in the `ld` component within the `bfd putl64()` function located in the `bfd/libbfd.c` file. This issue requires local access to be exploited.

A buffer overflow occurs in the `ld` component within the `elf x86 64 relocate section()` function located in the `bfd/elf64-x86-64.c` file. This issue is triggered by the manipulation of the `roff` argument and requires local access to be exploited.