Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

5 records

Vendor: haotian-liu Component: Llava Clear all filters
TI-2024-08640 CVE-2024-9308 · GHSA-hjcr-w68h-rg2p

Open Redirect in haotian-liu/llava

Priority MEDIUM 60

An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0053 Published 2025-03-20 No fix listed CWE-601
TI-2024-11192 CVE-2024-12065 · GHSA-q36w-fgp3-q2gw

Local File Inclusion in haotian-liu/llava

Priority HIGH 72

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00945 Published 2025-03-20 No fix listed CWE-22
TI-2024-08641 CVE-2024-9309 · GHSA-gggj-77q9-hf6x

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

Priority HIGH 79

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6).

CVSS 3.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2025-03-20 No fix listed CWE-918
TI-2024-11195 CVE-2024-12068 · GHSA-7hc9-vjg2-vpcr

Server-Side Request Forgery in haotian-liu/llava

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918
TI-2024-09481 CVE-2024-10225 · GHSA-745f-48gc-258q

Denial of Service in haotian-liu/llava

Priority HIGH 72

A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00637 Published 2025-03-20 No fix listed CWE-770