143 matches found
Exploit for Code Injection in Grafana
🛠️ CVE-2024-9264 - Fixed Grafana RCE Exploit This is a fixe...
SQL Injection
Overview llama-index-vector-stores-duckdb is a llama-index vectorstores duckdb integration Affected versions of this package are vulnerable to SQL Injection through the DuckDBVectorStore class. An attacker can manipulate the refdocid parameter, enabling them to read and write arbitrary files on t...
CVE-2024-8099
A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...
aporacle (>=0.0.126 <=0.0.143), assemblit (>=0.1.11 <=0.1.13) +17 more potentially affected by CVE-2024-8183 via prefect (>=2.0.0b16 <=2.19.4)
prefect PYPI version =2.0.0b16, =0.0.126, =0.1.11, =5.2.3, =2.37.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =0.3.2, =0.0.217, =0.1.1, =0.15.3, =0.6.5, =0.6.8 - orchestration-utils =0.0.1 - prefect-duckdb =0.1.0a1 and more Source cves: CVE-2024-8183 Source advisory: SNYK:PYTHON-PREFECT-9487016...
SQL Injection
Overview llama-index-retrievers-duckdb-retriever is a llama-index retrievers duckdb-retriever integration Affected versions of this package are vulnerable to SQL Injection in the retrieve function, which sends an unparameterized SQL query based on user input for the values of "search using string...
CVE-2024-8099
A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...
CVE-2024-11958 SQL Injection in run-llama/llama_index
A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...
CVE-2024-11958 SQL Injection in run-llama/llama_index
A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...
CVE-2024-11958 SQL Injection in run-llama/llama_index
A SQL injection vulnerability exists in the duckdbretriever component of the run-llama/llamaindex repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thi...
CVE-2024-8099 Server-Side Request Forgery (SSRF) in vanna-ai/vanna
A Server-Side Request Forgery SSRF vulnerability exists in the latest version of vanna-ai/vanna when using DuckDB as the database. An attacker can exploit this vulnerability by submitting crafted SQL queries that leverage DuckDB's default features, such as readcsv, readcsvauto, readtext, and...
CVE-2024-8099
CVE-2024-8099 describes a Server-Side Request Forgery (SSRF) in the latest version of vanna-ai/vanna when using DuckDB as the database. The vulnerability allows an attacker to craft SQL queries leveraging DuckDB default features such as read_csv, read_csv_auto, read_text, and read_blob to make un...
DB-GPT SQL注入漏洞
DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. DB-GPT version v0.6.0 suffers from a SQL injection vulnerability that originates from the web API POST /api/v1/editor/sql/run allows execution of arbitrary SQL queries, which can be...
PT-2025-12114
Name of the Vulnerable Software and Affected Versions run-llama/llama index versions prior to v0.4.0 Description A SQL injection vulnerability exists in the duckdb retriever component. The issue stems from constructing SQL queries without utilizing prepared statements, which allows for the...
Vanna 代码问题漏洞
Vanna is a personalized AI SQL agent from Vanna Inc. Vanna suffers from a code issue vulnerability that stems from a server-side request forgery when using DuckDB as a database, which allows an attacker to make unauthorized requests by submitting specially crafted SQL queries...
CVE-2024-41672
DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...
aau-gomapedge-etl (=0.4.1), altimate-dataminion (>=0.0.11 <=0.0.20) +45 more potentially affected by CVE-2024-41672 via duckdb (=1.0.0)
duckdb PYPI version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on duckdb and may be impacted: - aau-gomapedge-etl =0.4.1 - altimate-dataminion =0.0.11, =0.3.0.2, =0.14.0, =2.2.1, =0.2.2, =0.10.23, =0.10.0, =0.1.3, =1.0.1, =0.3.0, =0.7.3 and mo...
DuckDB < 1.1.0 Unauthorized Filesystem Read (CVE-2024-41672)
The version of DuckDB installed on the remote host is affected by a vulnerability as referenced in the CVE-2024-41672 advisory. - In versions 1.0.0 and prior, content in filesystem is accessible for reading using 'sniffcsv', even with 'enableexternalaccess=false'. This vulnerability provides an...
VulnCheck KEV: CVE-2024-5827
Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents ?php...
A SQL Injection in DuckDB via prompt can lead to RCE
Target Link Description sql = f""" SELECT ftsmainself.tablename.matchbm25self.nodeidcolumn, 'query' AS score, self.nodeidcolumn, self.textcolumn FROM self.tablename WHERE score IS NOT NULL ORDER BY score DESC LIMIT self.similaritytopk; """ The duckdbretriever performs "search using string" and...