1312403 matches found
Denial of service through memory exhaustion
This report is not public...
An user can view any others invite list
This report is not public...
SSRF via POST /api/proxy
This report is not public...
RCE & Full Read SSRF & Arbitrary File Read in /web_crawl endpoint
Description The webcrawl function in documentapp.py contains a RCE vulnerability. This function receives the URL parameter, accesses and obtains the HTML content of the URL through Chromium headless, and converts the HTML content into a PDF file. Users can obtain the converted PDF file through th...
SSRF via POST /v1/llm/add_llm and /v1/conversation/tts
This report is not public...
Internet Bug Bounty: CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize()
CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize A vulnerability was reported in the Django web framework's urlize function, which could lead to a denial-of-service attack. The issue was caused by a slow pattern in the urlize function when processing a user input string...
AWS VDP: CVE-2020-5902
CVE ID: CVE-2020-5902 Description: Affected Product: F5 BIG-IP Traffic Management User Interface TMUI Severity: Critical CVSS Score: 9.8 Description: Remote Code Execution RCE vulnerability in undisclosed pages of the TMUI CVE-2020-5902 is a critical vulnerability affecting the BIG-IP Traffic...
URL check not complete, lead to SSRF
This report is not public...
Denial of Service
This report is not public...
Web server DOS through run metrics
This report is not public...
Internet Bug Bounty: [CVE-2024-47888] Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text
There is a possible ReDoS vulnerability in the plaintextforblockquotenode helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888. Carefully crafted text was found to cause the plaintextforblockquotenode helper to take an unexpected amount of time, possibly...
Improper Role Modification by Admins for Billing Permissions
Description Admins, who do not have direct permissions to access billing resources, are able to change the permissions of existing users to have billing permissions. This can lead to a privilege escalation scenario where an administrator can: 1. Change the role of an existing user to include...
Lack of access control on /users/me/org endpoint
Description The /users/me/org route is not adequately protected by access control mechanisms such as a middleware. This lack of authorization allows unauthorized users to access information about all team members in the current organization, even if the user does not have sufficient privileges. A...
Remote Code Execution via Pickle Deserialization with Hard-Coded AuthKey in RPC Server
Description RagFlow implements an RPC server using Python's native multiprocessing package. It fully understands the use of AuthKey to access and control the group communication when applying multiprocessing for network conditions via socket, but the current implementation hard-coded the AuthKey ...
curl: When curl uses Schannel as TLS backend, it fails to enforce TLS 1.3 cipher suite selections correctly
Vulnerability description not provided...
XSS through document upload
This report is not public...
Denial of service through sshfs-client in tracking server
This report is not public...
Running user provided regular expression, lead to DOS
This report is not public...