repository icon
intel / neural-compressor Project repository

SOTA low-bit LLM quantization (INT8/FP8/INT4/FP4/NF4) & sparsity; leading model compression techniques on TensorFlow, PyTorch, and ONNX Runtime

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN91 DAYS

FIX

WITHIN135 DAYS

Insecure Randomness in Calibration Dataset Generation
hope4real
pending
Command Injection in Docker Run – Critical RCE
hope4real
pending
Command Injection in neural-compressor's test_tensorflow_auto_input_output.py
captain-n3m0
pending
Regular Expression Denial of Service (ReDoS) Vulnerability
tugar2003
pending
Path Traversal Vulnerability in Log File Writing Code
tugar2003
pending
Path Traversal Vulnerability in `--model_config` Argument
tugar2003
pending
Command Execution Vulnerability in load_config_mapping due to Unrestricted eval...
360vulnerabilityresearchinstitute
duplicate
Medium
command execution via unrestricted use of eval in load_config_mapping
aftersnows
self closed
Remote code execution via "get_tuning_history"
meme-dm
informative
High
SSRF via download_url
meme-dm
informative
Medium
SQL Injection in `update_result` Method
kr3ww
pending
•CVE-2024-39368
Timing Attack to guess secret_key
fatmo666
Low
•$20•CVE-2024-37181
Remote code execution via gRPC
fatmo666
High
•$750•CVE-2024-28028
Logic-based Requirement-Injection RCE caused by pip-installation injection with...
retr0reg
duplicate
Critical
Denial-of-Service due to unlimited Task.workers
retr0reg
duplicate
High
REDACTED
retr0reg
self closed
SQL Injection at /task/submit/
retr0reg
duplicate
Critical
SQL injection
kr3ww
not applicable
OS Command Injection in neural_solution
sunrisexu
High
•$750•CVE-2024-39766
Regular Expression Denial of Service (ReDoS) Vulnerability in semver Package
haribugbounty
informative
High
Secrets are hardcoded in the code
gij03
not applicable
SQL Injection
codevigilanteofficial
duplicate
Critical
Command Injection / RCE
raltheo
duplicate
Critical
Remote Code Execution (RCE) via Command Injection
charliebailly
duplicate
Critical
Arbitrary file reading via SQL Injection
williwollo
Critical
•$2500•CVE-2024-22476
[B301:blacklist] Pickle and modules that wrap it can be unsafe when used to dese...
hob1t
self closed
senstive information disclose duo to weak permissions in a short time window
lujiefsi
Medium
•$125•CVE-2024-21792
Remote code execution via 'task/submit' API
williwollo
Critical
•$1500•CVE-2024-22476
Key Management: Hardcoded Encryption Key
ngostuan
not applicable
Insecure SSL: Server Identity Verification Disabled
ngostuan
not applicable
Execute arbitrary commands when getting tensor information
happypwn1337
informative
High