Lollms

Lollms

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.4

CVE-2024-6985

Exploit
  • EPSS 0.05%
  • Veröffentlicht 11.10.2024 16:15:14
  • Zuletzt bearbeitet 15.11.2024 17:10:59

A path traversal vulnerability exists in the api open_personality_folder endpoint of parisneo/lollms-webui. This vulnerability allows an attacker to read any folder in the personality_folder on the victim's computer, even though sanitize_path is set....

6.3

CVE-2024-4499

Exploit
  • EPSS 0.1%
  • Veröffentlicht 24.06.2024 03:15:09
  • Zuletzt bearbeitet 21.11.2024 09:42:57

A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpa...

3.3

CVE-2024-3121

Exploit
  • EPSS 0.15%
  • Veröffentlicht 24.06.2024 00:15:09
  • Zuletzt bearbeitet 21.11.2024 09:28:56

A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject a...

7.5

CVE-2024-4881

Exploit
  • EPSS 0.31%
  • Veröffentlicht 06.06.2024 19:16:03
  • Zuletzt bearbeitet 21.11.2024 09:43:46

A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linu...

9.8

CVE-2024-3429

Exploit
  • EPSS 0.31%
  • Veröffentlicht 06.06.2024 19:16:02
  • Zuletzt bearbeitet 21.11.2024 09:29:35

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading wh...