3415 matches found
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-7035 Cross-Site Request Forgery (CSRF) in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...
CVE-2024-12375
The CVE-2024-12375 entry concerns a Local File Inclusion in automatic1111/stable-diffusion-webui, affecting the git version 82a973c. The vulnerability enables an attacker to read arbitrary files on the host by sending a specially crafted request to the application. The CVSS base score is 6.5 (Med...
CVE-2024-12375 Local File Inclusion in automatic1111/stable-diffusion-webui
A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attacker to read arbitrary files on the system by sending a specially crafted request to the application...
CVE-2024-7036
Open WebUI vulnerability CVE-2024-7036 is described in connected advisories as Open WebUI 0.3.8 containing an uncontrolled resource consumption flaw. An unauthenticated attacker can sign up with excessively large text in the name field, causing the Admin panel to become unresponsive and blocking ...
CVE-2024-9919 Missing Authentication Check in parisneo/lollms-webui
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/appname API endpoint does not call the checkaccess function to verify the clientid, enabling attackers to delete directories without...
CVE-2024-9919 Missing Authentication Check in parisneo/lollms-webui
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/appname API endpoint does not call the checkaccess function to verify the clientid, enabling attackers to delete directories without...
CVE-2024-9919 Missing Authentication Check in parisneo/lollms-webui
A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/appname API endpoint does not call the checkaccess function to verify the clientid, enabling attackers to delete directories without...
CVE-2024-7033 Arbitrary File Write in open-webui/open-webui
In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...
CVE-2024-7033
Open-WebUI (open-webui/open-webui) 0.3.8 contains an arbitrary file write vulnerability in the download_model endpoint. On Windows, improper path handling allows an attacker to manipulate the file path and write files to arbitrary locations on the server’s filesystem, potentially overwriting crit...
CVE-2024-10935 Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary,...
CVE-2024-10935
CVE-2024-10935 concerns automatic1111/stable-diffusion-webui v1.10.0. The issue arises when the server fails to handle excessive characters at the end of multipart boundaries, allowing malformed multipart requests to trigger excessive resource consumption and a complete DoS. The vulnerability is ...
CVE-2024-10935 Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle excessive characters appended to the end of multipart boundaries. This flaw can be exploited by sending malformed multipart requests with arbitrary characters at the end of the boundary,...
CVE-2024-7058 Relative Path Traversal in parisneo/lollms-webui
A vulnerability in the sanitizepath function in parisneo/lollms-webui v10 - latest allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directories within the personalityfolder on the victim's computer...
CVE-2024-7040 Improper Access Control in open-webui/open-webui
In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the userid parameter, it is possible to view the chats of any administrator,...