deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-3110
Published: 2024-06-06
Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link.
CVSS Score: 8.7 (HIGH)
CWE: CWE-79
References: https://github.com/mintplex-labs/anything-llm/commit/49f30e051c9f6e28977d57d0e5f49c1294094e41; https://huntr.com/bounties/c2895978-364d-412d-8825-c806606bcb85; https://github.com/mintplex-labs/anything-llm/commit/49f30e051c9f6e28977d57d0e5f49c1294094e41
CVE: CVE-2024-3149
Published: 2024-06-06
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information.
CVSS Score: 8.8 (HIGH)
CWE: CWE-918
References: https://github.com/mintplex-labs/anything-llm/commit/f4088d9348fa86dcebe9f97a18d39c0a6e92f15e; https://huntr.com/bounties/b230d76b-ae2d-440e-a25b-94ffaa7c4ff1; https://github.com/mintplex-labs/anything-llm/commit/f4088d9348fa86dcebe9f97a18d39c0a6e92f15e
CVE: CVE-2024-3150
Published: 2024-06-06
Description: In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-755, CWE-755
References: https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc; https://huntr.com/bounties/745f5c80-14ea-4055-9f15-a066ae93e5a3; https://github.com/mintplex-labs/anything-llm/commit/200bd7f0615347ed2efc07903d510e5a208b0afc
CVE: CVE-2024-3153
Published: 2024-06-06
Description: mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://github.com/mintplex-labs/anything-llm/commit/b8d37d9f43af2facab4c51146a46229a58cb53d9; https://huntr.com/bounties/7bb08e7b-fd99-411e-99bc-07f81f474635; https://github.com/mintplex-labs/anything-llm/commit/b8d37d9f43af2facab4c51146a46229a58cb53d9
CVE: CVE-2024-3166
Published: 2024-06-06
Description: A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-79
References: https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5ce; https://huntr.com/bounties/af288bd3-8824-4216-a294-ae9fb444e5db; https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5ce
CVE: CVE-2024-3234
Published: 2024-06-06
Description: The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the `web_assets` folder. However, the outdated version of gradio it employs is susceptible to path traversal, as identified in CVE-2023-51449. This vulnerability allows unauthorized users to bypass the intended restrictions and access sensitive files, such as `config.json`, which contains API keys. The issue affects the latest version of chuanhuchatgpt prior to the fixed version released on 20240305.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/6b8f7db347b390f6f8bd07ea2a4ef01a47382f00; https://huntr.com/bounties/277e3ff0-5878-4809-a4b9-73cdbb70dc9f; https://github.com/gaizhenbiao/chuanhuchatgpt/commit/6b8f7db347b390f6f8bd07ea2a4ef01a47382f00
CVE: CVE-2024-3322
Published: 2024-06-06
Description: A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5. The vulnerability arises from the improper limitation of a pathname to a restricted directory in the 'process_folder' function within 'lollms-webui/zoos/personalities_zoo/cyber_security/codeguard/scripts/processor.py'. Specifically, the function fails to properly sanitize user-supplied input for the 'code_folder_path', allowing an attacker to specify arbitrary paths using '../' or absolute paths. This flaw leads to arbitrary file read and overwrite capabilities in specified directories without limitations, posing a significant risk of sensitive information disclosure and unauthorized file manipulation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://github.com/parisneo/lollms-webui/commit/1e17df01e01d4d33599db2afaafe91d90b6f0189; https://huntr.com/bounties/e0822362-033a-4a71-b1dc-d803f03bd427; https://github.com/parisneo/lollms-webui/commit/1e17df01e01d4d33599db2afaafe91d90b6f0189
CVE: CVE-2024-3402
Published: 2024-06-06
Description: A stored Cross-Site Scripting (XSS) vulnerability existed in version (20240121) of gaizhenbiao/chuanhuchatgpt due to inadequate sanitization and validation of model output data. Despite user-input validation efforts, the application fails to properly sanitize or validate the output from the model, allowing for the injection and execution of malicious JavaScript code within the context of a user's browser. This vulnerability can lead to the execution of arbitrary JavaScript code in the context of other users' browsers, potentially resulting in the hijacking of victims' browsers.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://huntr.com/bounties/389570c4-0bf2-4bc3-84f5-2e7afdba8ed1; https://huntr.com/bounties/389570c4-0bf2-4bc3-84f5-2e7afdba8ed1
CVE: CVE-2024-3404
Published: 2024-06-06
Description: In gaizhenbiao/chuanhuchatgpt, specifically the version tagged as 20240121, there exists a vulnerability due to improper access control mechanisms. This flaw allows an authenticated attacker to bypass intended access restrictions and read the `history` files of other users, potentially leading to unauthorized access to sensitive information. The vulnerability is present in the application's handling of access control for the `history` path, where no adequate mechanism is in place to prevent an authenticated user from accessing another user's chat history files. This issue poses a significant risk as it could allow attackers to obtain sensitive information from the chat history of other users.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/ccc7479ace5c9e1a1d9f4daf2e794ffd3865fc2b; https://huntr.com/bounties/ed32fc32-cb8f-4fbd-8209-cc835d279699; https://huntr.com/bounties/ed32fc32-cb8f-4fbd-8209-cc835d279699
CVE: CVE-2024-3408
Published: 2024-06-06
Description: man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session cookie if authentication is enabled. Additionally, the application fails to properly restrict custom filter queries, enabling attackers to execute arbitrary code on the server by bypassing the restriction on the `/update-settings` endpoint, even when `enable_custom_filters` is not enabled. This vulnerability allows attackers to bypass authentication mechanisms and execute remote code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798, CWE-94, CWE-798
References: https://github.com/man-group/dtale/commit/32bd6fb4a63de779ff1e51823a456865ea3cbd13; https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91; https://huntr.com/bounties/57a06666-ff85-4577-af19-f3dfb7b02f91
CVE: CVE-2024-3429
Published: 2024-06-06
Description: A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions in `lollms_core\lollms\security.py`. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises due to insufficient sanitization of user-supplied input, enabling attackers to bypass the path traversal protection mechanisms by crafting malicious input. Successful exploitation could lead to unauthorized access to sensitive files, information disclosure, and potentially a denial of service (DoS) condition by including numerous large or resource-intensive files. This vulnerability affects the latest version prior to 9.6.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-29, CWE-22
References: https://github.com/parisneo/lollms/commit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9; https://huntr.com/bounties/fd8f50c8-17f0-40be-a2c6-bb8d80f7c409; https://github.com/parisneo/lollms/commit/f4424cfc3d6dfb3ad5ac17dd46801efe784933e9
CVE: CVE-2024-4320
Published: 2024-06-06
Description: A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of the `name` parameter in the `ExtensionBuilder().build_extension()` method, which allows for local file inclusion (LFI) leading to arbitrary code execution. An attacker can exploit this vulnerability by crafting a malicious `name` parameter that causes the server to load and execute a `__init__.py` file from an arbitrary location, such as the upload directory for discussions. This vulnerability affects the latest version of parisneo/lollms-webui and can lead to remote code execution without requiring user interaction, especially when the application is exposed to an external endpoint or operated in headless mode.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-29, CWE-22
References: https://huntr.com/bounties/d6564f04-0f59-4686-beb2[PII_REDACTED]9b; https://huntr.com/bounties/d6564f04-0f59-4686-beb2[PII_REDACTED]9b
CVE: CVE-2024-4851
Published: 2024-06-06
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the stangirard/quivr application, version 0.0.204, which allows attackers to access internal networks. The vulnerability is present in the crawl endpoint where the 'url' parameter can be manipulated to send HTTP requests to arbitrary URLs, thereby facilitating SSRF attacks. The affected code is located in the backend/routes/crawl_routes.py file, specifically within the crawl_endpoint function. This issue could allow attackers to interact with internal services that are accessible from the server hosting the application.
CVSS Score: 7.7 (HIGH)
CWE: CWE-918
References: https://huntr.com/bounties/b6011986-954a-47da-a60c-fc7aebc8005d; https://huntr.com/bounties/b6011986-954a-47da-a60c-fc7aebc8005d
CVE: CVE-2024-4881
Published: 2024-06-06
Description: A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0. The vulnerability arises due to improper validation of file paths between Windows and Linux environments, allowing attackers to traverse beyond the intended directory and read any file on the Windows system. Specifically, the application fails to adequately sanitize file paths containing backslashes (`\`), which can be exploited to access the root directory and read, or even delete, sensitive files. This issue was discovered in the context of the `/user_infos` endpoint, where a crafted request using backslashes to reference a file (e.g., `\windows\win.ini`) could result in unauthorized file access. The impact of this vulnerability includes the potential for attackers to access sensitive information such as environment variables, database files, and configuration files, which could lead to further compromise of the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-36, CWE-22
References: https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6; https://huntr.com/bounties/94f7f901-80b0-4cf5-b545-ac5c1e7635e9; https://github.com/parisneo/lollms/commit/95ad36eeffc6a6be3e3f35ed35a384d768f0ecf6
CVE: CVE-2024-4888
Published: 2024-06-06
Description: BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the `/audio/transcriptions` endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes the specified file without proper authorization or validation. This vulnerability is present in the code where `os.remove(file.filename)` is used to delete a file, allowing any user to delete critical files on the server such as SSH keys, SQLite databases, or configuration files.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862, CWE-862
References: https://huntr.com/bounties/48461d89-cf13-4ad3-a43e-0d37da08fc6c; https://huntr.com/bounties/48461d89-cf13-4ad3-a43e-0d37da08fc6c
CVE: CVE-2024-4890
Published: 2024-06-06
Description: A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'user_id' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability by injecting malicious SQL commands through the 'user_id' parameter, leading to potential unauthorized access to sensitive information such as API keys, user information, and tokens stored in the database. The affected version is 1.27.14.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-89
References: https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2; https://huntr.com/bounties/a4f6d357-5b44-4e00-9cac-f1cc351211d2
CVE: CVE-2024-5124
Published: 2024-06-06
Description: A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Python. This method of comparison allows an attacker to guess passwords based on the timing of each character's comparison. The issue arises from the code segment that checks a password for a particular username, which can lead to the exposure of sensitive information to an unauthorized actor. An attacker exploiting this vulnerability could potentially guess user passwords, compromising the security of the system.
CVSS Score: 7.5 (HIGH)
CWE: CWE-203, CWE-203
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/e46ec4ecd896bc3c88eb9a2f44e8593f3c6761b4; https://huntr.com/bounties/e85ec077-930a-4597-975f-9341d2805641; https://huntr.com/bounties/e85ec077-930a-4597-975f-9341d2805641
CVE: CVE-2024-5126
Published: 2024-06-06
Description: An improper access control vulnerability exists in the lunary-ai/lunary repository, specifically within the versions.patch functionality for updating prompts. Affected versions include 1.2.2 up to but not including 1.2.25. The vulnerability allows unauthorized users to update prompt details due to insufficient access control checks. This issue was addressed and fixed in version 1.2.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297; https://huntr.com/bounties/8e7e1267-ea6c-4789-b9dc-3410dfac6ec6; https://github.com/lunary-ai/lunary/commit/b7bd3a830a0f47ba07d0fd57bf78c4dd8a216297
CVE: CVE-2024-5128
Published: 2024-06-06
Description: An Insecure Direct Object Reference (IDOR) vulnerability was identified in lunary-ai/lunary, affecting versions up to and including 1.2.2. This vulnerability allows unauthorized users to view, update, or delete any dataset_prompt or dataset_prompt_variation within any dataset or project. The issue stems from improper access control checks in the dataset management endpoints, where direct references to object IDs are not adequately secured against unauthorized access. This vulnerability was fixed in version 1.2.25.
CVSS Score: 8.8 (HIGH)
CWE: CWE-639, CWE-639
References: https://github.com/lunary-ai/lunary/commit/0755dde1afc2a74ec23b55eee03e4416916cf48f; https://huntr.com/bounties/11248071-11b2-42d9-991a-504bf2044332; https://github.com/lunary-ai/lunary/commit/0755dde1afc2a74ec23b55eee03e4416916cf48f
CVE: CVE-2024-5129
Published: 2024-06-06
Description: A Privilege Escalation Vulnerability exists in lunary-ai/lunary version 1.2.2, where any user can delete any datasets due to missing authorization checks. The vulnerability is present in the dataset deletion functionality, where the application fails to verify if the user requesting the deletion has the appropriate permissions. This allows unauthorized users to send a DELETE request to the server and delete any dataset by specifying its ID. The issue is located in the datasets.delete function within the datasets index file.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862, CWE-862
References: https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776; https://huntr.com/bounties/a6c0deb3-6a4c-4188-8aaa-9e6207f82f44; https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
CVE: CVE-2024-5130
Published: 2024-06-06
Description: An Incorrect Authorization vulnerability exists in lunary-ai/lunary versions up to and including 1.2.2, which allows unauthenticated users to delete any dataset. The vulnerability is due to the lack of proper authorization checks in the dataset deletion endpoint. Specifically, the endpoint does not verify if the provided project ID belongs to the current user, thereby allowing any dataset to be deleted without proper authentication. This issue was fixed in version 1.2.8.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-639
References: https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776; https://huntr.com/bounties/e81a9871-308d-4628-9726-af66643a16fe; https://github.com/lunary-ai/lunary/commit/14078c1d2b8766075bf655f187ece24c7a787776
CVE: CVE-2024-5131
Published: 2024-06-06
Description: An Improper Access Control vulnerability exists in the lunary-ai/lunary repository, affecting versions up to and including 1.2.2. The vulnerability allows unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequately verify the ownership of the prompt ID. This issue was fixed in version 1.2.25.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/lunary-ai/lunary/commit/ddfd497afd017a6946c582a1a806687fdac888bf; https://huntr.com/bounties/52c129f2-114e-492f-aee8-32c78f75ac4f; https://github.com/lunary-ai/lunary/commit/ddfd497afd017a6946c582a1a806687fdac888bf
CVE: CVE-2024-5132
Published: 2024-06-06
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-5133
Published: 2024-06-06
Description: In lunary-ai/lunary version 1.2.4, an account takeover vulnerability exists due to the exposure of password recovery tokens in API responses. Specifically, when a user initiates the password reset process, the recovery token is included in the response of the `GET /v1/users/me/org` endpoint, which lists all users in a team. This allows any authenticated user to capture the recovery token of another user and subsequently change that user's password without consent, effectively taking over the account. The issue lies in the inclusion of the `recovery_token` attribute in the users object returned by the API.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b; https://huntr.com/bounties/6057598d-93c4-4a94-bb80-5bd508013c5b
CVE: CVE-2024-5186
Published: 2024-06-06
Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt version 0.5.0. This vulnerability allows attackers to send crafted requests that could result in unauthorized access to the local network and potentially sensitive information. Specifically, by manipulating the 'path' parameter in a file upload request, an attacker can cause the application to make arbitrary requests to internal services, including the AWS metadata endpoint. This issue could lead to the exposure of internal servers and sensitive data.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918, CWE-918
References: https://huntr.com/bounties/5f[PII_REDACTED]-4a67-a421-ee1bc4b6e3a3; https://huntr.com/bounties/5f[PII_REDACTED]-4a67-a421-ee1bc4b6e3a3
CVE: CVE-2024-5187
Published: 2024-06-06
Description: A vulnerability in the `download_model_with_test_data` function of the onnx/onnx framework, version 1.16.0, allows for arbitrary file overwrite due to inadequate prevention of path traversal attacks in malicious tar files. This vulnerability enables attackers to overwrite any file on the system, potentially leading to remote code execution, deletion of system, personal, or application files, thus impacting the integrity and availability of the system. The issue arises from the function's handling of tar file extraction without performing security checks on the paths within the tar file, as demonstrated by the ability to overwrite the `/home/kali/.ssh/authorized_keys` file by specifying an absolute path in the malicious tar file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237e; https://huntr.com/bounties/50235ebd-3410-4ada-b064-1a648e11237e