Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

3 records

Vendor: haotian-liu Component: Large Language And Vision Assistant Clear all filters
TI-2024-11197 CVE-2024-12070 · GHSA-r4hm-vcvh-rm39

Denial of Service in haotian-liu/llava

Priority HIGH 72

A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2025-03-20 No fix listed CWE-400
TI-2024-08643 CVE-2024-9311 · GHSA-4wfj-v7c8-rwh4

Cross-Site Request Forgery to XSS in haotian-liu/llava

Priority MEDIUM 60

A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious content without authentication or user interaction.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00216 Published 2025-03-20 No fix listed CWE-352
TI-2024-10610 CVE-2024-11449 · GHSA-22h9-9rvv-q9qg

Server-Side Request Forgery in haotian-liu/llava

Priority HIGH 72

A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918