PT-2025-52282

Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description Dify version 1.9.1 has an issue with insecure permissions. An attacker who is not authenticated can send HTTP GET requests to the /console/api/system-features API endpoint without providing any authentication. Th...

PT-2025-52262

Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description A Cross-Origin Resource Sharing CORS misconfiguration exists in the /console/api/setup endpoint. The endpoint has an insecure CORS policy that reflects any Origin header and allows Access-Control-Allow-Credential...

CVE-2025-63386

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains t...

CVE-2025-63388: Origin Validation Error

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any...

CVE-2025-63387: Improper Access Control

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

EUVD-2022-43181

Malicious code in bioql PyPI...

Malicious code in hide-console-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 553d9f1d98ecb2b448f09091adba1ab0cdce9e4f07391a50fc002ba74669645a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3100 Malicious code in hide-console-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 553d9f1d98ecb2b448f09091adba1ab0cdce9e4f07391a50fc002ba74669645a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in hide-console-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

com.vip.saturn:saturn-console (>=3.0.0-m1, <=3.5.1), com.vip.saturn:saturn-it (>=3.0.0-m5, <=3.5.1) potentially affected by CVE-2025-29085 via com.vip.saturn:saturn-console-api (>=3.0.0-m1, <=3.5.1)

com.vip.saturn:saturn-console-api MAVEN version =3.0.0-m1, =3.0.0-m1, =3.0.0-m5, =3.5.1 Source cves: CVE-2025-29085 Source advisory: SNYK:JAVA-COMVIPSATURN-9749461...

CVE-2024-12775

langgenius/dify version 0.10.1 contains a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API "POST /console/api/workspaces/current/tool-provider/api/test/pre". Attackers can set the "url" in the "servers" dictionary in...

CVE-2024-11821

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

PT-2025-12110

Name of the Vulnerable Software and Affected Versions langgenius/dify version 0.9.1 Description A privilege escalation issue exists, allowing a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The problem arises because the application does not properly enfor...

CVE-2024-11821: Execution with Unnecessary Privileges

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2021-42718: Insecure Storage of Sensitive Information

Information Disclosure in API in Replicated Replicated Classic versions prior to 2.53.1 on all platforms allows authenticated users with Admin Console access to retrieve sensitive data, including application secrets, via accessing container definitions with environment variables through the Admin...

BIT-MINIO-2023-28434 MinIO is vulnerable to privilege escalation on Linux/MacOS

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

MinIO Security Feature Bypass Vulnerability

MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket to conduct privilege escalation. To carry out this attack, the attacker requires...

Privilege Escalation

github.com/minio/minio is vulnerable to Privilege Escalation. An attacker is able to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To achieve this, the attacker needs credentials with arn:aws:s3::: permission and...

CVE-2023-28434

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...

Code injection

Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing PostPolicyBucket. To carry out this attack, the attacker requires credentials wit...