Hrp

**Name of the Vulnerable Software and Affected Versions** localai versions <=2.20.1 **Description** The issue is related to a Cross Site Scripting (XSS) vulnerability. When the delete model API is called with inappropriate parameters, it can cause a one-time storage XSS. This will trigger the payload when a user accesses the homepage. The vulnerability occurs in the delete model API when bad parameters are used. **Recommendations** For localai versions <=2.20.1, as a temporary workaround, consider restricting access to the delete model API until a patch is available. Avoid using inappropriate parameters in the delete model API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** langflow versions <=1.0.18 **Description** The issue allows for Remote Code Execution (RCE) because any component that provides code functionality runs on the local machine rather than in a sandbox. **Recommendations** For versions <=1.0.18, update to a version above 1.0.18 to resolve the issue. As a temporary workaround, consider restricting the use of components that provide code functionality to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PyTorch versions prior to 2.4.1 **Description** The issue concerns the RemoteModule in PyTorch, which is reported to have Deserialization RCE. However, it is noted that this behavior is intended in PyTorch distributed computing and is disputed by multiple parties. **Recommendations** For versions prior to 2.4.1, consider restricting the use of the RemoteModule to minimize the risk of exploitation until a clearer resolution or guidance is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** chainer version 7.8.1.post1 **Description** A Deserialization of Untrusted Data issue allows for the execution of arbitrary code. **Recommendations** For version 7.8.1.post1, update to a version that fixes the Deserialization of Untrusted Data issue to prevent arbitrary code execution.

Name of the Vulnerable Software and Affected Versions: H2O.ai H2O versions 3.46.0.4 and earlier Description: The issue allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the "ImportSQLTable" URI with a JSON document containing a `connection url` property with any typical JDBC Connection URL attack payload. Recommendations: For versions 3.46.0.4 and earlier, update to a patched version to resolve the issue. As a temporary workaround, consider restricting access to the ImportSQLTable URI to minimize the risk of exploitation. Avoid using the `connection url` property in the affected JSON documents until the issue is resolved.