CVE-2024-6827

CVE-2024-6827 affects Gunicorn 21.2.0 where Transfer-Encoding is not properly validated, causing fallback to Content-Length and TE.CL HTTP request smuggling. This can lead to cache poisoning, data exposure, session manipulation, SSRF, XSS, DoS, and data integrity issues. Root cause: improper vali...

CVE-2024-8099 Server-Side Request Forgery (SSRF) in vanna-ai/vanna

A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...

CVE-2024-8099 Server-Side Request Forgery (SSRF) in vanna-ai/vanna

A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...

CVE-2024-8099

CVE-2024-8099 describes a Server-Side Request Forgery (SSRF) in the latest version of vanna-ai/vanna when using DuckDB as the database. The vulnerability allows an attacker to craft SQL queries leveraging DuckDB default features such as read_csv, read_csv_auto, read_text, and read_blob to make un...

CVE-2024-9309

CVE-2024-9309 is a Server-Side Request Forgery (SSRF) affecting the Controller API Server of haotian-liu/llava v1.2.0 (LLaVA-1.6). The vulnerability exists in the POST /worker_generate_stream endpoint and could allow an attacker to leverage the server’s credentials to perform unauthorized web act...

CVE-2024-9309 SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 LLaVA-1.6. This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized...

CVE-2024-9309 SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 LLaVA-1.6. This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized...

CVE-2024-8955 SSRF in composiohq/composio

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...

CVE-2024-8955 SSRF in composiohq/composio

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...

CVE-2024-8955 SSRF in composiohq/composio

A Server-Side Request Forgery SSRF vulnerability exists in composiohq/composio version v0.4.4. This vulnerability allows an attacker to read the contents of any file in the system by exploiting the BROWSERTOOLGOTOPAGE and BROWSERTOOLGETPAGEDETAILS actions...

CVE-2024-8955

Affected product: composiohq/composio v0.4.4. Vulnerability type: Server-Side Request Forgery (SSRF) via BROWSERTOOL_GOTO_PAGE and BROWSERTOOL_GET_PAGE_DETAILS actions. Root cause / impact: insufficient validation/handling of user-supplied URLs enables an attacker to read files from the system; i...

CVE-2024-12775 SSRF in langgenius/dify

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's...

CVE-2024-12775 SSRF in langgenius/dify

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's...

CVE-2024-12775 SSRF in langgenius/dify

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. Attackers can set the url in the servers dictionary in OpenAI's...

CVE-2024-12775

CVE-2024-12775 describes an SSRF in langgenius/dify v0.10.1, triggered via the test functionality of Create Custom Tool in REST API POST /console/api/workspaces/current/tool-provider/api/test/pre. The flaw allows an attacker to provide an arbitrary URL in the servers.url field of the OpenAI schem...

CVE-2024-11031

Vulnerability: binary-husky/gpt_academic v3.83 has an SSRF flaw in Markdown_Translate.get_files_from_everything() exploitable via the HotReload plugin, which trusts HTTP links to fetch arbitrary hosts and can leverage the victim GPT Academic’s Gradio Web server credentials. Documented impact: una...

CVE-2024-11822

The CVE-2024-11822 issue affects langgenius/dify version 0.9.1 and is caused by improper handling of the api_endpoint parameter, enabling Server-Side Request Forgery (SSRF). The vulnerability allows an attacker to make direct requests from the server to internal network services, potentially expo...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...

CVE-2024-11822 Server-Side Request Forgery (SSRF) in langgenius/dify

langgenius/dify version 0.9.1 contains a Server-Side Request Forgery SSRF vulnerability. The vulnerability exists due to improper handling of the apiendpoint parameter, allowing an attacker to make direct requests to internal network services. This can lead to unauthorized access to internal...