CVE-2025-61163

A flaw was found in Cohere North AI. The server fails to properly validate the Origin header of incoming connection requests, leading to an excessively permissive cross-domain policy with untrusted domains. This vulnerability could allow an attacker to gain unauthorized access to sensitive...

CVE-2025-61164

A flaw was found in Cohere North AI. This vulnerability allows for an information leak through its WebSocket Endpoint. A remote attacker could exploit this to gain unauthorized access to sensitive data. Mitigation Disable the affected WebSocket endpoint in the service configuration, or restrict...

CVE-2025-61162

A flaw was found in Cohere North AI. This incorrect access control vulnerability allows a remote attacker to send a specially crafted request to a specific API endpoint. This action enables the attacker to arbitrarily overwrite user information. The primary impact is unauthorized modification of...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

EUVD-2025-210784

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2025-61162

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

CVE-2025-61165

Cohere North AI v1.1.5 contains an arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component that allows unauthenticated remote attackers to achieve arbitrary code execution by uploading a crafted file. The CNA-assigned CVSS v3.1 score is 9.8 (Critical) (AV:N/AC:L/PR:N/UI:N/S...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

CVE-2025-61162

Cohere North AI v1.1.5 is affected by an incorrect access control flaw in the /api/internal/v1/users/{{USER_ID}} endpoint, which allows an unauthenticated, remote attacker to arbitrarily overwrite user information via a crafted request. The CVSS 3.1 score is 7.5 (HIGH) , reflecting a network atta...

CVE-2025-61163

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61164

Cohere North AI v1.1.5 was found to contain an information leak via its WebSocket Endpoint . The vulnerability requires no authentication and is exploitable over the network with low complexity, resulting in a high impact on confidentiality with no integrity or availability impact (CVSS 3.1 score...

CVE-2025-61164

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2025-210786

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...

CVE-2025-61163

Cohere North AI v1.1.5 contains an excessively permissive cross-domain policy with untrusted domains , caused by the server failing to validate the Origin header of incoming connection requests. This allows untrusted domains to interact with the service, rated CVSS 9.8 (Critical) with high impact...