1143 matches found
CVE-2024-28816
The CVE identifies a SQL injection in the Student Information Chatbot a0196ab, exposed via the login username parameter in index.php. The underlying flaw is unsanitized user input passed to a SQL query in the login function, enabling potential unauthorized access or data exposure. Exploitation st...
WordPress AI Engine: ChatGPT Chatbot Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)
Software AI Engine: ChatGPT Chatbot Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0378 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c9bd74cd8e71 Credits...
AnythingLLM Access Control Error Vulnerability
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM is vulnerable to an access control error vulnerability that stems from the presence of an access control error vulnerability...
Number withdrawn
Chat LangChain is a locally hosted chatbot implementation dedicated to answering questions via LangChain documents. This CVE number has been withdrawn...
A Pornhub Chatbot Stopped Millions From Searching for Child Abuse Videos
Every time someone in the UK searched for child abuse material on Pornhub, a chatbot appeared and told them how to get help...
AnythingLLM Code Issue Vulnerability
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a code issue vulnerability that stems from the presence of a server-side request forgery vulnerability. The vulnerability can be exploited to obtain AWS server data...
AnythingLLM Security Vulnerability
AnythingLLM is a business-compliant document chatbot. AnythingLLM has a security vulnerability that stems from the lack of any validation and is capable of including malicious links into submitted document links in the workspace...
AnythingLLM Security Vulnerability
AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a security vulnerability that stems from insufficient password checking...
Microsoft Is Spying on Users of Its AI Tools
Microsoft announced that it caught Chinese, Russian, and Iranian hackers using its AI tools--presumably coding tools--to improve their hacking abilities. From their report: In collaboration with OpenAI, we are sharing threat intelligence showing detected state affiliated adversaries--tracked as...
CVE-2024-21624
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...
Design/Logic Flaw
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...
CVE-2024-21624
Summary (CVE-2024-21624): nonebot2, a Python-based asynchronous chatbot framework, has a potential information leak in user-constructed templates via the MessageTemplate mechanism. The root cause involves incorporating user-provided data into templates, which may expose sensitive data (e.g., envi...
CVE-2024-21624 Potential Information Leak in User-Constructed Message Templates in nonebot2
nonebot2 is a cross-platform Python asynchronous chatbot framework written in Python. This security advisory pertains to a potential information leak e.g., environment variables in instances where developers utilize MessageTemplate and incorporate user-provided data into templates. The identified...
ChatGPT accused of breaking data protection rules
Italys Data Protection Authority GPDP has uncovered data privacy violations related to collecting personal data and age protections after an inquiry into OpenAI’s ChatGPT. OpenAI has 30 days to respond with a defense. ChatGPT is an artificial intelligence AI chatbot that can engage in conversatio...
CVE-2024-24566
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. This vulnerabili...
Authorization
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. This vulnerabili...
CVE-2024-24566 Lobe Chat unauthorized access to plugins
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. This vulnerabili...
CVE-2024-24566
CVE-2024-24566 affects Lobe Chat: improper access control lets users access plugins without password when ACCESS_CODE is used. Documented PoC shows exploitation via /api/plugin/gateway; impact is unauthorized plugin access. The issue is patched in version 0.122.4; remediation is to upgrade to 0.1...