CVE-2024-11821 Privilege Escalation in langgenius/dify

A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce access controls on the endpoint...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

CVE-2025-1796 Admin account takeover through weak Pseudo-Random number generator used in generating password reset codes in langgenius/dify

A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random number generator PRNG used for generating password reset codes. The application uses random.randint for this purpose, which is not suitable...

PT-2025-12145 · Unknown +1 · Langgenius/Dify +1

Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: The issue is a Server-Side Request Forgery SSRF vulnerability in the test functionality for the Create Custom Tool option via the REST API endpoint POST...

PT-2025-12146 · Langgenius · Dify

Name of the Vulnerable Software and Affected Versions: langgenius/dify version 0.10.1 Description: The issue concerns the /forgot-password/resets endpoint, which does not verify the password reset code. This allows an attacker to reset the password of any user, including administrators, potential...

dify 安全特征问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security feature issue vulnerability exists in dify version v0.10.1 that stems from a weak pseudo-random number generator that could lead to account takeover...

dify 代码问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.1 of dify, which stems from an unvalidated URL and could lead to a server-side request forgery attack...

dify 代码问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.2 of dify, which stems from the Create Knowledge section when uploading DOCX files is vulnerable to server-side request forgery attacks...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in dify version v0.10.1, which stems from an unlimited number of password reset code guessing attempts, which could lead to a fully cracked account...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 0.9.1 of dify, which stems from improper access control and could lead to elevation of privilege...