469 matches found
CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
CVE-2025-11750: Missing Standardized Error Handling Mechanism
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
dify security vulnerabilities
dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.6.0 of dify, which stems from the authentication mechanism returning different error messages for non-existing and existing accounts, potentially leading to an...
CVE-2025-58747
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl...
CVE-2025-58747
CVE-2025-58747 affects Dify up to version 1.9.1, where the MCP OAuth flow passes the remote server’s authorization_url directly to window.open without validation, enabling arbitrary JavaScript execution (XSS) when a victim connects to a malicious MCP server. Affected component: MCP OAuth in Dify....
CVE-2025-58747 Dify MCP OAuth Flow Vulnerable to XSS
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl...
CVE-2025-58747 Dify MCP OAuth Flow Vulnerable to XSS
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl...
PT-2025-42619
Name of the Vulnerable Software and Affected Versions Dify versions through 1.9.1 Description The Dify platform, used for LLM application development, has a flaw in its MCP OAuth component. When a user connects to a remotely controlled MCP server managed by an attacker, cross-site scripting can...
Dify cross-site scripting vulnerabilities
Dify is an open source LLM application development platform from LangGenius Open Source. A cross-site scripting vulnerability exists in Dify 1.9.1 and earlier versions, which stems from a failure to validate or clean up the authorizationurl in the implementation of the OAuth process, which could...
CVE-2025-58747: Improper Neutralization of Input During Web Page Generation
Dify is an LLM application development platform. In Dify versions through 1.9.1, the MCP OAuth component is vulnerable to cross-site scripting when a victim connects to an attacker-controlled remote MCP server. The vulnerability exists in the OAuth flow implementation where the authorizationurl...
Malicious code in dify-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d98e6fba7e9370347c73e0d316cbd3fb83b1cb2e50f5e17a6423d321afa21a59 The OpenSSF Package Analysis project identified 'dify-web' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2025-47907 Malicious code in dify-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d98e6fba7e9370347c73e0d316cbd3fb83b1cb2e50f5e17a6423d321afa21a59 The OpenSSF Package Analysis project identified 'dify-web' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...
EUVD-2025-32433
Malicious code in dify-web npm...
EUVD-2025-11837
Malicious code in bioql PyPI...
EUVD-2025-20208
Malicious code in bioql PyPI...
EUVD-2025-18567
Malicious code in bioql PyPI...
EUVD-2025-7010
Malicious code in bioql PyPI...