1312403 matches found
Lack of unique constraint validation allows overwriting evaluators
Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...
Node.js: GOAWAY HTTP/2 frames cause memory leak outside heap
A memory leak could occur when a remote peer abruptly closed the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected by nghttp2, causing the connection to be terminated by the peer, the same leak was triggered. This flaw could have led to increased memory...
Logging into webui as view only internal user provides overly privileged bearer key
Description When an user with the role "internaluserviewer" logs into the application they are provided with an overly privileged API key. This key can be used to access all the admin functionality of the application. The following steps are taken: An admin creates an Internal User with the role...
curl: information disclosure
Summary: web.archive.org -website web. Archive is a website like google search, but he saves all links. Wayback disclosing URL's without users' permission, Anyone can access them maybe emails and passwords they are notes they should be private and see everything just by searching about random not...
Partial Account Takeover due to Insecure Data Querying
This report is not public...
Denial of service through batched queries in GraphQL
This report is not public...
Improper Access Control Allows deleting other users' reminders
Description Because the report I reported before was exploited on the public, I created a new report to exploit on the local machine The vulnerability allows users to delete other users' prompts on the system via the groupid parameter Proof of Concept const deletePromptController = async req, res...
SQL Injection in default_jsonalyzer via prompt injection leads to arbitrary file creation
Target Link Description defaultjsonalyzer function used in JSONalyzeQueryEngine execute a sqlite query that llm made. If the attacker control the sqlite query with prompt injection and execute a malicious sqlite query, then Denial-of-Service attack and arbitrary file creation is possible. Root...
Exception unhandled, lead to server crash
Description In node js express, if exception is uncaught, the server will crash. fs module sometimes throw exception when dealing with file upload. Unauth user can send something to the server trigger the exception lead to server crash. Proof of Concept import requests import random import string...
Path traversal, lead to arbitrary file write, lead to remote code execution
Description Anythingllm use multer library to handle http multi-part file upload. Anything llm use the following code to handle non-ascii file name file.originalname = Buffer.fromfile.originalname, "latin1".toString "utf8" ; This way of manipulating filename is will lead to path traversal. multer...
Remitly: [CRITICAL] 0-Click Account Takeover via Password Reset [AUTH-3243] /orchestrator/v1/password_reset/start
The vulnerability discovered allows an attacker to reset the password of a victim's account without requiring any user interaction or special privileges. By intercepting the password reset request and modifying it with the victim's session data, the attacker can successfully take over the account...
curl: netrc crlf injection
Summary: Curl allows CR and LF characters to be encoded in login and password netrc fields. This allows an attacker who can affect contents of the netrc entry to inject FTP commands by injecting CRLF to the login or password. POP3 is likely affected as well, but hasn't been tested. The only...
Arbitrary file deletion on Windows via the '/v1/agent/hub/update' endpoint.
This report is not public...
Remote Code Execution via Model Deserialization on /api/v2/models/install API
Summary I have identified a critical vulnerability leading to remote code execution in the /api/v2/models/install API through unsafe model deserialization. The API allows users to specify a model URL, which is downloaded and loaded server-side using torch.load without proper validation. This...
IBM: SQL injection identified on IBM endpoint.
SQL injection vulnerability was identified on an IBM endpoint. The issue was reported to IBM, analyzed, and remediated...
Leakage of Langfuse API keys in team exception handling
This report is not public...
Mars: Customer Data Exposure via Insecure Endpoint of coupon
A security vulnerability was identified in the Royal Canin Greece website. An insecure API endpoint was exposed that allowed unauthorized access to customer information without requiring authentication. The endpoint related to coupon functionality and revealed sensitive customer data, including...
Mars: change part of personal information all users
The report describes a vulnerability in the ██████████ website, where unauthorized access to an API endpoint allowed attackers to add new users and modify personal information of existing users. The vulnerability was classified as Improper Access Control. The issue stemmed from the absence of...
Mars: Users Data Exposure via Insecure Endpoint
An insecure endpoint on the Mars Royal Canin website exposed sensitive customer information without proper authentication. Personal data, including full names, phone numbers, email addresses, physical addresses, and postal codes, was accessible through a simple API endpoint that could be accessed...