0X1F

**Name of the Vulnerable Software and Affected Versions** Milvus versions prior to 2.5.27 Milvus versions prior to 2.6.10 **Description** Milvus, an open-source vector database for generative AI applications, is affected by an issue that allows authentication bypasses. The software exposes TCP port 9091 by default, and the `/expr` debug endpoint uses a weak, predictable default authentication token derived from `etcd.rootPath` (default: by-dev), enabling arbitrary expression evaluation. The full REST API (`/api/v1/*`) is registered on the metrics/management port without authentication, allowing unauthenticated access to all business operations, including data manipulation and credential management. **Recommendations** Milvus versions prior to 2.5.27 should be upgraded to version 2.5.27 or later. Milvus versions prior to 2.6.10 should be upgraded to version 2.6.10 or later.

**Name of the Vulnerable Software and Affected Versions** milvus versions up to 2.6.7 **Description** A security issue has been identified in milvus. The `expr.Exec` function within the `pkg/util/expr/expr.go` file, associated with the HTTP Endpoint component, is susceptible to deserialization due to manipulation of the `code` argument. Remote exploitation is possible, and the exploit has been publicly disclosed. **Recommendations** milvus versions prior to 2.6.8 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** geyang ml-logger versions prior to acf255bade5be6ad88d90735c8367b28cbe3a743 **Description** A path traversal issue exists in the `log handler` function within the `ml logger/server.py` file. Manipulation of the `File` argument can lead to unauthorized file access. This issue is potentially exploitable remotely and an exploit is publicly available. **Recommendations** Update to a version later than acf255bade5be6ad88d90735c8367b28cbe3a743. As a temporary workaround, restrict access to the `ml logger/server.py` file. Avoid using the `File` parameter in the `log handler` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** LazyAGI LazyLLM versions prior to 0.6.2 **Description** A security issue has been identified in LazyAGI LazyLLM. This concerns the deserialization of data within the `lazyllm call` function located in the `lazyllm/components/deploy/relay/server.py` file. This manipulation can be initiated remotely. The details of the exploit have been publicly disclosed. **Recommendations** Update to a version later than 0.6.1.

**Name of the Vulnerable Software and Affected Versions** geyang ml-logger versions prior to acf255bade5be6ad88d90735c8367b28cbe3a743 **Description** A security flaw exists in geyang ml-logger. The issue resides in the `stream handler` function within the `ml logger/server.py` file of the File Handler component. Manipulation of the `key` argument can lead to information disclosure. This attack can be initiated remotely and the exploit has been publicly released. **Recommendations** Update geyang ml-logger to a version later than acf255bade5be6ad88d90735c8367b28cbe3a743. As a temporary workaround, consider restricting access to the `stream handler` function until a patch is available. Avoid using or carefully sanitize the `key` argument passed to the `stream handler` function.

**Name of the Vulnerable Software and Affected Versions** geyang ml-logger (affected versions not specified) **Description** A flaw exists in geyang ml-logger. The `log handler` function within the `ml logger/server.py` file, specifically in the Ping Handler component, is susceptible to deserialization due to manipulation of the `data` argument. This issue can be triggered remotely. The exploit has been publicly disclosed. As this product uses a rolling release model, specific version details for affected or updated releases are unavailable. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** miurla morphic versions prior to 0.4.5 **Description** A flaw has been found in miurla morphic. This impacts the `fetchHtml` function of the file `/api/advanced-search` of the component HTTP Status Code 3xx Handler, causing server-side request forgery. The attack is possible to be carried out remotely. **Recommendations** Update miurla morphic to a version later than 0.4.5. As a temporary workaround, consider restricting access to the `/api/advanced-search` endpoint.

**Name of the Vulnerable Software and Affected Versions** SimStudioAI versions prior to 51b1e97fa22c48d144aef75f8ca31a74ad2cfed2 **Description** A server-side request forgery issue exists due to unknown processing within the file `apps/sim/app/api/proxy/image/route.ts`. The attack can be performed remotely. The exploit has been made public. **Recommendations** Apply patch 3424a338b763115f0269b209e777608e4cd31785 to resolve this issue.