EUVD-2025-210787

Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/USERID endpoint...

EUVD-2025-210785

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint...

EUVD-2025-210784

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2025-61165

CVE-2025-61165 affects cohere North AI v1.1.5 , where the /v1/my_drive/batch_upload API endpoint is susceptible to an arbitrary file upload vulnerability. An attacker can upload a crafted file through this endpoint to achieve arbitrary code execution on the target system. No specific CVSS metrics...

CVE-2025-61164

Cohere North AI v1.1.5 was found to contain an information leak via its WebSocket Endpoint . The vulnerability allows unauthorized exposure of data through the WebSocket communication channel, though the specific data types leaked and the severity impact are not detailed in the provided documents...

CVE-2025-61163

Cohere North AI v1.1.5 contains an excessively permissive cross-domain policy that allows untrusted domains to interact with the service. The root cause is the server failing to validate the Origin header of incoming connection requests, effectively granting cross-origin access to any domain with...

CVE-2025-61162

CVE-2025-61162 is an incorrect access control vulnerability in Cohere North AI v1.1.5 . An attacker can send a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint to arbitrarily overwrite user information , implying a lack of proper authorization checks on an internal API route. Th...

EUVD-2025-210786

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests...