Microsoft Azure Health Bot security vulnerabilities

Microsoft Azure Health Bot is an Artificial Intelligence-based service from Microsoft Corporation USA designed to provide automated chatbot solutions for healthcare. A security vulnerability exists in Microsoft Azure Health Bot. An attacker exploiting the vulnerability can elevate privileges...

CVE-2024-11821

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

New Phishing Scam Uses Fake Instagram Chatbot to Hijack Accounts

New phishing scam targets Instagram business accounts using fake chatbots and support emails, tricking users into handing over login credentials...

MAL-2025-2561 Malicious code in chatbot-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5af371ce3024a5ed217ff2baf8b2a9443cf92ae8a1993552e3679be6f83698a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11821

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11850

A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11821

CVE-2024-11821 affects langgenius/dify 0.9.1. The issue is a privilege escalation where a normal user can modify Orchestrate instructions for an admin-created chatbot due to improper access control on the endpoint /console/api/apps/{chatbot-id}/model-config. The CVE entry lists a CVSSv3 base scor...

CVE-2024-11821

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

Malicious code in n11-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a368f528c1eb4b3da0f52628aed3b3e5ca54083842086c30a70a91d1110a3cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2559 Malicious code in n11-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a368f528c1eb4b3da0f52628aed3b3e5ca54083842086c30a70a91d1110a3cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11821: Execution with Unnecessary Privileges

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

PT-2025-12113

Name of the Vulnerable Software and Affected Versions langgenius/dify affected versions not specified Description A stored cross-site scripting XSS issue exists due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit th...

PT-2025-12110

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.9.1 Description A privilege escalation issue exists, allowing a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The problem arises because the application does not properly enfor...

CVE-2024-11850: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this vulnerability by injecting malicious SVG...

AI Chatbot DeepSeek R1 Can Be Manipulated to Create Malware

Tenable Research reveals that AI chatbot DeepSeek R1 can be manipulated to generate keyloggers and ransomware code. While…...

CVE-2024-13882: Unrestricted Upload of File with Dangerous Type

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomaticgeneratefeaturedimage' function in all versions up to, and including, 2.3.8. This makes...

CVE-2024-13816: Missing Authorization

The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability checks on multiple functions in all versions up to, and including, 2.3.6. This mak...