Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

8 records

Vendor: haotian-liu Clear all filters
TI-2024-11197 CVE-2024-12070 · GHSA-r4hm-vcvh-rm39

Denial of Service in haotian-liu/llava

Priority HIGH 72

A Denial of Service (DoS) vulnerability exists in the file upload feature of haotian-liu/llava, specifically in Release v1.2.0 (LLaVA-1.6).

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00878 Published 2025-03-20 No fix listed CWE-400
TI-2024-08640 CVE-2024-9308 · GHSA-hjcr-w68h-rg2p

Open Redirect in haotian-liu/llava

Priority MEDIUM 60

An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0053 Published 2025-03-20 No fix listed CWE-601
TI-2024-08643 CVE-2024-9311 · GHSA-4wfj-v7c8-rwh4

Cross-Site Request Forgery to XSS in haotian-liu/llava

Priority MEDIUM 60

A Cross-Site Request Forgery (CSRF) vulnerability in haotian-liu/llava v1.2.0 (LLaVA-1.6) allows an attacker to upload files with malicious content without authentication or user interaction.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00216 Published 2025-03-20 No fix listed CWE-352
TI-2024-11192 CVE-2024-12065 · GHSA-q36w-fgp3-q2gw

Local File Inclusion in haotian-liu/llava

Priority HIGH 72

A local file inclusion vulnerability exists in haotian-liu/llava at commit c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00945 Published 2025-03-20 No fix listed CWE-22
TI-2024-08641 CVE-2024-9309 · GHSA-gggj-77q9-hf6x

SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

Priority HIGH 79

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6).

CVSS 3.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00512 Published 2025-03-20 No fix listed CWE-918
TI-2024-11195 CVE-2024-12068 · GHSA-7hc9-vjg2-vpcr

Server-Side Request Forgery in haotian-liu/llava

Priority HIGH 72

A Server-Side Request Forgery (SSRF) vulnerability was discovered in haotian-liu/llava, affecting version git c121f04.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918
TI-2024-09481 CVE-2024-10225 · GHSA-745f-48gc-258q

Denial of Service in haotian-liu/llava

Priority HIGH 72

A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00637 Published 2025-03-20 No fix listed CWE-770
TI-2024-10610 CVE-2024-11449 · GHSA-22h9-9rvv-q9qg

Server-Side Request Forgery in haotian-liu/llava

Priority HIGH 72

A vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6) allows for Server-Side Request Forgery (SSRF) through the /run/predict endpoint.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.007 Published 2025-03-20 No fix listed CWE-918