Approved changes feed: RSS · Atom
cpe:2.3:a:hliu:llava:1.2.0:*:*:*:*:*:*:*
part: a version: 1.2.0 update: *
| Vendor | Hliu (48b7630b-3b00-5631-b4d1-0b546621b537) |
|---|---|
| Product | Llava (5f63e2ef-4669-5973-80b8-a3e1555c9378) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/haotian-liu/llava |
purl2cpe | 2026-06-01 10:17:12.526128 |
pkg:golang/github.com/haotian-liu/llava |
purl2cpe | 2026-06-01 10:17:12.526132 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-9309 |
vulnerable | 2026-06-08 07:00:27.101647 |
SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava
CRITICAL (9.3)
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.
Published: 2025-03-20T10:09:43.094Z
Updated: 2025-03-20T18:35:40.977Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9308 |
vulnerable | 2026-06-08 07:00:27.101181 |
Open Redirect in haotian-liu/llava
MEDIUM (6.1)
An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.
Published: 2025-03-20T10:10:36.502Z
Updated: 2025-03-20T18:19:20.435Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10225 |
vulnerable | 2026-06-08 06:22:03.809169 |
Denial of Service in haotian-liu/llava
HIGH (7.5)
A vulnerability in haotian-liu/llava v1.2.0 allows an attacker to cause a Denial of Service (DoS) by appending a large number of characters to the end of a multipart boundary in a file upload request. This causes the server to continuously process each character, rendering the application inaccessible.
Published: 2025-03-20T10:08:54.041Z
Updated: 2025-10-15T12:49:22.767Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.