CVE-2024-12871

CVE-2024-12871 describes a stored XSS in infiniflow/ragflow (0.12.0) where uploading a malicious PDF to the knowledge base leads to payload execution when viewed in Ragflow. The impact stated across sources includes session hijacking, data exfiltration, and unauthorized actions performed in the u...

CVE-2024-8057 Improper Access Control in danswer-ai/danswer

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to...

CVE-2024-9365

CVE-2024-9365 describes a Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon v2.4.0 . The vulnerability enables attackers to perform unauthorized actions in the victim’s browser context, including creating projects, model versions, and artifact versions, or changing settings, with potential d...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2024-10363 Improper Access Control in danny-avila/LibreChat

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...

CVE-2024-10363 Improper Access Control in danny-avila/LibreChat

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...

CVE-2024-10363

CVE-2024-10363 affects the LibreChat project (danny-avila/LibreChat) version 0.7.5. The vulnerability is an improper access control that allows users to share, use, and create prompts without admin authorization, potentially breaking application logic and permissions and enabling unauthorized act...

CVE-2024-11045 Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui

A Cross-Site WebSocket Hijacking CSWSH vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at...

CVE-2024-8065

CVE-2024-8065 describes a Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of the open‑source project danswer-ai/danswer. The issue arises because the application does not implement any CSRF protection, allowing an attacker to perform unauthorized actions in the context of the vi...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

CVE-2024-7035

The CVE-2024-7035 issue affects open-webui/open-webui (v0.3.8). The underlying problem is CSRF because sensitive actions (delete/reset) are invoked via GET requests. Affected endpoints include /rag/api/v1/reset, /rag/api/v1/reset/db, /api/v1/memories/reset, and /rag/api/v1/reset/uploads, impactin...

CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

CVE-2024-7036

Open WebUI vulnerability CVE-2024-7036 is described in connected advisories as Open WebUI 0.3.8 containing an uncontrolled resource consumption flaw. An unauthenticated attacker can sign up with excessively large text in the name field, causing the Admin panel to become unresponsive and blocking ...

CVE-2024-8955 SSRF in composiohq/composio

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...