CVE-2024-6674

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

CVE-2024-6673

A Cross-Site Request Forgery CSRF vulnerability exists in the installcomfyui endpoint of the lollmscomfyui.py file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into...

CVE-2024-6581

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6581

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

PYSEC-2024-116

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6673

CVE-2024-6673 describes a CSRF vulnerability in the Parisneo LoLLMS WebUI. The issue exists in the install_comfyui endpoint of the lollms_comfyui.py file and is triggered via a GET request without client authentication, allowing an attacker to coerce a user into installing ComfyUI. Affected versi...

CVE-2024-6673 CSRF Vulnerability in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the installcomfyui endpoint of the lollmscomfyui.py file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into...

CVE-2024-6673 CSRF Vulnerability in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the installcomfyui endpoint of the lollmscomfyui.py file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into...

CVE-2024-6673 CSRF Vulnerability in parisneo/lollms-webui

A Cross-Site Request Forgery CSRF vulnerability exists in the installcomfyui endpoint of the lollmscomfyui.py file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into...

CVE-2024-6581 Remote Code Execution due to Stored XSS in parisneo/lollms

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6581

Summary: CVE-2024-6581 matches a vulnerability in Lollms (v9.9) where the SVG upload filter in sanitize_svg fails to neutralize all SVG-based vectors, enabling cross-site scripting (XSS) and potentially remote code execution when an authorized user accesses a crafted SVG URL. What’s affected: Lol...

CVE-2024-6581 Remote Code Execution due to Stored XSS in parisneo/lollms

A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitizesvg function, this can lead to cross-site scripting XSS vulnerabilities, which in turn pose a risk of remote code...

CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

CVE-2024-6674 Data Leak through CORS Misconfiguration in parisneo/lollms-webui

A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing private API keys from other services. This vulnerability can also enable attackers to perform actions on behalf of a user,...

PT-2024-37791 · Unknown · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: lollms-webui versions prior to 10 Description: A CORS misconfiguration allows attackers to steal sensitive information, such as logs, browser sessions, and settings containing private API keys from other services. This issue can also enable...

LoLLMs 跨站请求伪造漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version v9.9, which stems from the presence of a cross-site request forgery CSRF vulnerability that allows an attacker to trick a...

PT-2024-37790 · Unknown · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: lollms-webui versions v9.9 through the latest Description: A Cross-Site Request Forgery CSRF issue exists in the "install comfyui" endpoint of the lollms comfyui.py file. This endpoint uses the GET method without requiring a client ID, allowi...

LoLLMs 跨站脚本漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site scripting vulnerability exists in LoLLMs v9.9, which stems from allowing SVG files to be uploaded, and could lead to a cross-site scripting XSS vulnerability, which in turn poses a...

PT-2024-37735 · Lollms · Lollms

Name of the Vulnerable Software and Affected Versions: Lollms version v9.9 Description: A vulnerability in the discussion image upload function allows for the uploading of SVG files, which can lead to cross-site scripting XSS vulnerabilities and pose a risk of remote code execution. The sanitize...