54 matches found
PT-2024-25012
Name of the Vulnerable Software and Affected Versions lobe-chat versions prior to 1.19.13 Description Lobe Chat is an open-source, AI chat framework. The issue allows an attacker to construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive...
WordPress AI Chatbot with ChatGPT by AYS plugin <= 2.0.9 - Unauthenticated OpenAI Key Disclosure vulnerability
Unauthenticated OpenAI Key Disclosure vulnerability discovered by Kieran Burge in WordPress Plugin AI ChatBot with ChatGPT and Content Generator by AYS versions = 2.0.9...
WordPress plugin AI Chatbot with ChatGPT by AYS 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin AI Chatbot...
PT-2024-38529 · Ays · Ayswp Chatbot
Name of the Vulnerable Software and Affected Versions: The AI ChatBot with ChatGPT and Content Generator by AYS WordPress plugin versions prior to 2.1.0 Description: The issue allows unauthenticated users to obtain the Open AI API Key. This is due to the disclosure of the Open AI API Key in the...
CVE-2024-6845
The Chatbot with ChatGPT WordPress plugin before 2.4.6 does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key...
PT-2024-37899
Name of the Vulnerable Software and Affected Versions The Chatbot with ChatGPT WordPress plugin versions prior to 2.4.6 Description The issue is related to a lack of proper authorization in one of the plugin's REST endpoints, allowing unauthenticated users to retrieve an encoded key, which can th...
GHSA-G26J-5385-HHW3 LiteLLM Server-Side Request Forgery (SSRF) vulnerability
A Server-Side Request Forgery SSRF vulnerability exists in berriai/litellm version 1.38.10. This vulnerability allows users to specify the apibase parameter when making requests to POST /chat/completions, causing the application to send the request to the domain specified by apibase. This request...
PT-2024-37739
Name of the Vulnerable Software and Affected Versions berriai/litellm version 1.38.10 Description A Server-Side Request Forgery SSRF vulnerability exists, allowing users to specify the api base parameter when making requests to POST /chat/completions. This causes the application to send the reque...
CVE-2024-4858
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'savetestimonialsoptioncallback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated attackers to updat...
CVE-2024-34527
spacesplugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged...
CVE-2024-34527: Insertion of Sensitive Information into Log File
spacesplugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. The printed string might be logged...
CVE-2024-34527
SolidUI version 0.4.0 contains a security vulnerability in the spaces_plugin/app.py component. The issue is caused by an unnecessary print statement for an OpenAI key , which could result in the sensitive key being captured in application logs. To mitigate this risk, it is recommended to remove o...
PT-2024-25949 · Solidui · Solidui
Name of the Vulnerable Software and Affected Versions: SolidUI version 0.4.0 Description: The issue concerns an unnecessary print statement in the spaces plugin/app.py file for an OpenAI key. This printed string might be logged, potentially exposing sensitive information. Recommendations: For...
