Improperly Controlled Modification of Dynamically-Determined Object Attributes (Mass Assignment)

FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. At time of publication, there are no publ

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the assistant update endpoint of FlowiseAI. The endpoint allows authenticated users t

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the chatflow update endpoint of FlowiseAI. The endpoint allows clients to modify serv

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the tool update endpoint of FlowiseAI. The endpoint allows authenticated users to mod

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint allows authenticated users to

FlowiseAI: Evaluator create+update mass-assignment allows cross-workspace evaluator takeover

FlowiseAI: Evaluation create+update mass-assignment allows cross-workspace evaluation takeover

FlowiseAI: CustomTemplate create+update mass-assignment allows cross-workspace template takeover

FlowiseAI: DatasetRow create+update mass-assignment allows cross-workspace row takeover

FlowiseAI: Dataset create+update mass-assignment allows cross-workspace dataset takeover

IRIS is a web collaborative platform that helps incident responders share technical details during investigations. Versions prior to 2.4.28 allow a user to alter values in the database via manipulated API requests. Version 2.4.28 contains a