AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. An input validation error vulnerability exists in AnythingLLM that stems from improper input validation, where a user with the administrator role is able to craft a request containing a nested write operation to create a new...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in versions of AnythingLLM prior to 1.0.0 that stems from a lack of input validation and cleanup, resulting in uncontrolled resource consumption and a denial of service DoS...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from the fact that an attacker can accept a single user invitation by sending multiple concurrent requests, thereby allowing the creation of multiple user accounts from a...

AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an input validation error vulnerability that stems from allowing an attacker to delete all existing users and potentially create new administrator users without a password, leading to unauthorized access...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a security vulnerability that stems from the lack of a black and white attribute list, allowing an attacker to create elevated privilege accounts without authorization...

AnythingLLM 路径遍历漏洞

AnythingLLM is a document chatbot that meets business requirements. A path traversal vulnerability exists in AnythingLLM that stems from insufficient input validation and normalization when processing file and folder deletion requests, allowing an unauthorized attacker with a default role account...

AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an input validation error vulnerability that stems from a failure to properly clean user-supplied input, allowing an attacker to read and delete arbitrary files on the server...

CVE-2024-3570 Stored XSS leading to Admin Account Takeover in mintplex-labs/anything-llm

A stored Cross-Site Scripting XSS vulnerability exists in the chat functionality of the mintplex-labs/anything-llm repository, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating the ChatBot responses, an attacker can inject malicious scripts to...

PT-2024-26648 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: A stored Cross-Site Scripting XSS vulnerability exists in the chat functionality, allowing attackers to execute arbitrary JavaScript in the context of a user's session. By manipulating...

AnythingLLM 输入验证错误漏洞

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has an input validation error vulnerability that stems from an incorrect input validation vulnerability that allows an attacker to escalate privileges by disabling Multi-User Mode...

AnythingLLM 资源管理错误漏洞

AnythingLLM is a document chatbot that meets business requirements. A resource management error vulnerability exists in AnythingLLM that stems from a denial of service DoS vulnerability when the application is run in just me mode using a password...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from allowing users with the Manager role to escalate their privileges to the Administrator role via a bulk assignment issue...

AnythingLLM 跨站脚本漏洞

AnythingLLM is a document chatbot that meets business requirements. A cross-site scripting vulnerability exists in AnythingLLM that stems from a stored cross-site scripting XSS vulnerability in the chat functionality...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from insufficient validation of user-supplied input in the logo filename feature, which could lead to a path traversal attack...

CVE-2024-0765 Default user role exporting save state of instance

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

CVE-2024-0765

The CVE-2024-0765 entry concerns AnythingLLM where a default user on a multi‑user instance can call the /export-data endpoint, unzip/read the export, and exfiltrate system data at the saved state. The vulnerability relies on export functionality accessible to users with explicit system access at ...

PT-2024-15802 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: AnythingLLM affected versions not specified Description: The issue allows a default user on a multi-user instance to execute a call to the "/export-data" endpoint, enabling them to exfiltrate data of the system at that save state. This requir...

AnythingLLM Information Disclosure Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an information disclosure vulnerability that stems from allowing the default/manager user to obtain all system database information such as username, password, apikey, etc...

AnythingLLM Access Control Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM is vulnerable to an access control error vulnerability that stems from the presence of an access control error vulnerability...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM. An attacker exploiting this vulnerability could set its profile picture via the front-end API using a relative file path and then download any valid file using the PFP GET API...