CVE-2024-10481

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as...

CVE-2024-10363

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...

CVE-2024-10956 Cross-Site WebSocket Hijacking in binary-husky/gpt_academic

GPT Academy version 3.83 in the binary-husky/gptacademic repository is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting...

CVE-2024-10956 Cross-Site WebSocket Hijacking in binary-husky/gpt_academic

GPT Academy version 3.83 in the binary-husky/gptacademic repository is vulnerable to Cross-Site WebSocket Hijacking CSWSH. This vulnerability allows an attacker to hijack an existing WebSocket connection between the victim's browser and the server, enabling unauthorized actions such as deleting...

CVE-2024-7767

CVE-2024-7767 affects danswer-ai/danswer v0.3.94. The root cause is improper access control, enabling the first user created in the system to view, modify, and delete chats created by an Admin. Reported impact includes unauthorized access to sensitive information and potential data integrity issu...

CVE-2024-12871 Stored Cross-site Scripting (XSS) in infiniflow/ragflow

An XSS vulnerability in infiniflow/ragflow version 0.12.0 allows an attacker to upload a malicious PDF file to the knowledge base. When the file is viewed within Ragflow, the payload is executed in the context of the user's browser. This can lead to session hijacking, data exfiltration, or...

CVE-2024-12871

CVE-2024-12871 describes a stored XSS in infiniflow/ragflow (0.12.0) where uploading a malicious PDF to the knowledge base leads to payload execution when viewed in Ragflow. The impact stated across sources includes session hijacking, data exfiltration, and unauthorized actions performed in the u...

CVE-2024-8057 Improper Access Control in danswer-ai/danswer

In version 0.4.1 of danswer-ai/danswer, a vulnerability exists where a basic user can create credentials and link them to an existing connector. This issue arises because the system allows an unauthenticated attacker to sign up with a basic account and perform actions that should be restricted to...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2024-9365 Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon

A Cross-Site Request Forgery CSRF vulnerability in polyaxon/polyaxon v2.4.0 allows attackers to perform unauthorized actions in the context of the victim's browser. This includes creating projects, model versions, and artifact versions, or changing settings. The impact of this vulnerability...

CVE-2024-9365

CVE-2024-9365 describes a Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon v2.4.0 . The vulnerability enables attackers to perform unauthorized actions in the victim’s browser context, including creating projects, model versions, and artifact versions, or changing settings, with potential d...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2025-1473 CSRF in mlflow/mlflow

A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...

CVE-2024-10363 Improper Access Control in danny-avila/LibreChat

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...

CVE-2024-10363 Improper Access Control in danny-avila/LibreChat

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions...

CVE-2024-10363

CVE-2024-10363 affects the LibreChat project (danny-avila/LibreChat) version 0.7.5. The vulnerability is an improper access control that allows users to share, use, and create prompts without admin authorization, potentially breaking application logic and permissions and enabling unauthorized act...

CVE-2024-11045 Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui

A Cross-Site WebSocket Hijacking CSWSH vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability arises from the lack of proper validation on WebSocket connections at...

CVE-2024-8065

CVE-2024-8065 describes a Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of the open‑source project danswer-ai/danswer. The issue arises because the application does not implement any CSRF protection, allowing an attacker to perform unauthorized actions in the context of the vi...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...

CVE-2024-8065 CSRF in danswer-ai/danswer

A Cross-Site Request Forgery CSRF vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions in the context of the victim's browser. This includes connecting the victim's application with a malicious Slack Bot, inviting users, and deleting chats, among...