Threats tagged 'ghsa-qv68-3gfq-wxpc'

DeepInfer versions through 0.1.0 have a path traversal vulnerability in the unauthenticated /profile endpoint. This flaw allows remote attackers to create arbitrary directories via the output_dir parameter. Exploitation can include cross-site GET requests from an operator's browser to write chrome trace files, potentially exhausting disk space or inodes and using error messages as a filesystem oracle.