2009 matches found
CVE-2024-9606
In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...
CVE-2024-11037
A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...
CVE-2024-10109
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
CVE-2025-0628 Improper Authorization in BerriAI/litellm
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...
CVE-2025-0628
CVE-2025-0628 affects the main-latest version of BerriAI/litellm. The issue allows an user with the internal_user_viewer role to obtain an overly privileged API key that can access admin endpoints (e.g., /users/list, /users/get_users), enabling privilege escalation to a PROXY ADMIN. Multiple sour...
CVE-2025-0628 Improper Authorization in BerriAI/litellm
An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internaluserviewer' logs into the application, they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the applicatio...
CVE-2024-8954 Authentication Bypass in composiohq/composio
In composiohq/composio version 0.5.10, the API does not validate the x-api-key header's value during the authentication step. This vulnerability allows an attacker to bypass authentication by providing any random value in the x-api-key header, thereby gaining unauthorized access to the server...
CVE-2024-10109
CVE-2024-10109 affects the mintplex-labs/anything-llm repository (commit 5c40419). Affected component: API endpoint /api/system/custom-models, exposed to low-privilege users. Root cause described as insufficient authorization allowing access to a sensitive endpoint, enabling modification of the m...
CVE-2024-10109 Incorrect Authorization in mintplex-labs/anything-llm
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
CVE-2024-10109 Incorrect Authorization in mintplex-labs/anything-llm
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of...
CVE-2024-9606 Improper Output Neutralization for Logs in berriai/litellm
In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...
CVE-2024-9606
CVE-2024-9606 — Improper API key masking in Litellm A vulnerability in berriai/litellm prior to 1.44.12 arises from the masking logic in litellm_logging.py, which only masks the first 5 characters of API keys. This allows leakage of most of the secret key in logs, as noted for version v1.44.9 and...
CVE-2024-9606 Improper Output Neutralization for Logs in berriai/litellm
In berriai/litellm before version 1.44.12, the litellm/litellmcoreutils/litellmlogging.py file contains a vulnerability where the API key masking code only masks the first 5 characters of the key. This results in the leakage of almost the entire API key in the logs, exposing a significant amount ...
CVE-2024-11037
CVE-2024-11037 affects binary-husky/gpt_academic. A path traversal flaw at commit 679352d allows bypassing blocked_paths and reading config.py containing sensitive data (e.g., OpenAI API key). Exploitation is described as Windows-specific via a URL containing the project’s absolute path. No mitig...
CVE-2024-11037 Path Traversal in binary-husky/gpt_academic
A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...
CVE-2024-11037 Path Traversal in binary-husky/gpt_academic
A path traversal vulnerability exists in binary-husky/gptacademic at commit 679352d, which allows an attacker to bypass the blockedpaths protection and read the config.py file containing sensitive information such as the OpenAI API key. This vulnerability is exploitable on Windows operating syste...
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...
CVE-2025-30197
Jenkins Zoho QEngine Plugin 1.0.29.vfacc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe and capture it...