CVE-2024-32881

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-32881

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-32881 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-32881 Unauthorized access to GET/SET of Slack Bot Tokens in Danswer

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

CVE-2024-32881

CVE-2024-32881 affects Danswer (AI Assistant). The vulnerability allows unauthorized GET/SET access to Slack Bot Tokens, enabling token theft and full compromise of the customer’s Slack bot and internal Slack access. The issue is tied to Danswer versions prior to 3.63. Remediation from the connec...

PT-2024-24937

Name of the Vulnerable Software and Affected Versions Danswer versions prior to 3.63 Description Danswer, the AI Assistant connected to a company's documents, applications, and people, is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. This vulnerability allows anyone with netwo...

CVE-2024-32881: Improper Authorization

Danswer is the AI Assistant connected to company's docs, apps, and people. Danswer is vulnerable to unauthorized access to GET/SET of Slack Bot Tokens. Anyone with network access can steal slack bot tokens and set them. This implies full compromise of the customer's slack bot, leading to internal...

Danswer security vulnerabilities

Danswer is Danswer AI open source an artificial intelligence assistant that connects to company documents, applications and people. Danswer has a security vulnerability that stems from Vulnerability to GET/SET unauthorized access to Slack Bot tokens...

Leaktopus - Keep Your Source Code Under Control

Keep your source code under control. Key Features Plug &Play - one line installation with Docker. Scan various sources containing a set of keywords, e.g. ORGANIZATION-NAME.com. Currently supports: GitHub Repositories Gists coming soon Paste sites e.g., PasteBin coming soon Filter results with a...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2022-40897 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2022-40897 Source advisory:...

fedlearner (>=1.5.0.dev20210429, <=1.5.0.dev20210512), fedlearner-manylinux (1.5.0.dev20210429) +4 more potentially affected by CVE-2022-40897 via setuptools (41.0.0)

setuptools PYPI version 41.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - fedlearner =1.5.0.dev20210429, =0.0.1, =0.0.3, =0.0.1, =0.0.2 - toskose 0.1.0 Source cves: CVE-2022-40897 Source advisory:...

Plaintext Storage of a Password in Jenkins Build Notifications Plugin

Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml\n- Slack Bot Token in...