Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
691 results · page 3 of 14
Apr 4, 2025A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic.CVE-2025-3252 · Other software · xujiangfei · reported by VulDBMedium 5.1
A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2025A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0.CVE-2025-3251 · Other software · xujiangfei · reported by VulDBMedium 5.1
A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- admintwo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection.CVE-2024-8251 · Other software · mintplex-labs · reported by security@huntr.devMedium 5.3
A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionalitCVE-2024-8249 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this vulnerability by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception. This issue is fixed in version 1.2.2.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and wrCVE-2024-8248 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and write in the storage directory. This can result in privilege escalation from manager to admin. The issue is fixed in version 1.2.2.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default.CVE-2024-8196 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.8
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default. This vulnerability allows an attacker to gain full backend access, enabling them to perform actions such as deleting all data from the workspace.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service.CVE-2024-7771 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
A vulnerability in the Dockerized version of mintplex-labs/anything-llm (latest, digest 1d9452da2b92) allows for a denial of service. Uploading an audio file with a very low sample rate causes the functionality responsible for transcribing it to crash the entire site instance. The issue arises from the localWhisper implementation, where resampling the audio file from 1 Hz to 16000 Hz quickly exceeds available memory, leading to the Docker instance being killed by the instance manager.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings.CVE-2024-6842 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameteCVE-2024-13060 · Other software · mintplex-labs · reported by security@huntr.devMedium 4.3
A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2.CVE-2024-10513 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the vulnerable endpoint '/api/document/move-files', an attacker can move the database file to a publicly accessible directory, download it, and subsequently delete it. This can lead to unauthorized access to sensitive data, privilege escalation, and potential data loss.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/systemCVE-2024-10109 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.3
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2025Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control.CVE-2024-31525 · Other software · reported by MITREHigh 7.2
Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. A regular registered user is able to elevate his privileges to admin and gain complete access to the system as the authorization mechanism is not validated on the server side and only on the client side. This can result, for example, in creating a new admin user in the system which enables persistent access for the attacker as an administrator.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcwe.mitre.orggithub.com
Feb 11, 2025Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.CVE-2025-1052 · Other software · Mintty · reported by zdi-disclosures@trendmicro.comHigh 8.8
Mintty Sixel Image Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Mintty. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of sixel images. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-23382.
- Product
- Mintty
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2025A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer libCVE-2024-13059 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when the filename transformation introduces '../' sequences, which are not sanitized by multer, allowing attackers with manager or admin roles to write files to arbitrary locations on the server.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 27, 2025Minterpress: Missing AuthorizationCVE-2025-23529 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 8, 2025In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code.CVE-2023-35685 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DevmemIntMapPages of devicemem_server.c, there is a possible physical page uaf due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordissuetracker.google.com
Dec 16, 2024Minterpress: Missing AuthorizationCVE-2024-54379 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Privilege Escalation.This issue affects Minterpress: from n/a through <= 1.0.5.
- Product
- Minterpress
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Minterpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 13, 2024In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check.CVE-2024-40671 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 13, 2024In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.CVE-2023-35659 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DevmemIntChangeSparse of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint functioCVE-2024-51427 · Other software · ethereum · reported by MITRECritical 9.8
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
- Product
- ethereum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 29, 2024mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSONCVE-2024-7783 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 10, 2024In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition.CVE-2024-23716 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2024An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint.CVE-2024-3279 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.1
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or collect information about them. The vulnerability stems from the application's failure to properly restrict access to the data-import functionality, allowing unauthorized database manipulation.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2024Unquoted Search Path or Element vulnerability in ABB Mint Workbench.CVE-2024-5402 · Other software · ABB · reported by cybersecurity@ch.abb.comMedium 6.2
Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Workbench I versions: from 5866 before 5868.
- Product
- Mint Workbench I
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsearch.abb.comsearch.abb.com
Jul 9, 2024In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition.CVE-2024-34725 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 9, 2024In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.CVE-2024-31335 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 9, 2024In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code.CVE-2024-31334 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jul 8, 2024RailsAdmin is a Rails engine that provides an interface for managing data.CVE-2024-39308 · Other software · railsadminteam · reported by GitHubMedium 5.4
RailsAdmin is a Rails engine that provides an interface for managing data. RailsAdmin list view has the XSS vulnerability, caused by improperly-escaped HTML title attribute. Upgrade to 3.1.3 or 2.2.2 (to be released).
- Product
- rails_admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2024A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption.CVE-2024-5216 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption. Specifically, the issue arises from the application's failure to limit the size of usernames, enabling attackers to create users with excessively bulky texts in the username field. This exploit results in the user management panel becoming unresponsive, preventing administrators from performing critical user management actions such as editing, suspending, or deleting users. The impact of this vulnerability includes administrative paralysis, compromised security, and operational disruption, as it allows malicious users to perpetuate their presence within the system indefinitely, undermines the system's security posture, and degrades overall system performance.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after loCVE-2024-5213 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exposure occurs because the entire User object, including the bcrypt password hash, is included in the response sent to the frontend. This practice could potentially lead to sensitive information exposure despite the use of bcrypt, a strong hashing algorithm. It is recommended not to expose any clues about passwords to the frontend.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2024An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm.CVE-2024-5208 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
An uncontrolled resource consumption vulnerability exists in the `upload-link` endpoint of mintplex-labs/anything-llm. This vulnerability allows attackers to cause a denial of service (DOS) by shutting down the server through sending invalid upload requests. Specifically, the server can be made to shut down by sending an empty body with a 'Content-Length: 0' header or by sending a body with arbitrary content, such as 'asdasdasd', with a 'Content-Length: 9' header. The vulnerability is reproducible by users with at least a 'Manager' role, sending a crafted request to any workspace. This issue indicates that a previous fix was not effective in mitigating the vulnerability.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 14, 2024In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.CVE-2024-36656 · Other software · minthcm · reported by MITREMedium 6.1
In MintHCM 4.0.3, a registered user can execute arbitrary JavaScript code and achieve a reflected Cross-site Scripting (XSS) attack.
- Product
- minthcm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2024A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversCVE-2024-5211 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traversal attacks. This vulnerability enables the manager to read, delete, or overwrite the 'anythingllm.db' database file and other files stored in the 'storage' directory, such as internal communication keys and .env secrets. Exploitation of this vulnerability could lead to application compromise, denial of service (DoS) attacks, and unauthorized admin account takeover. The issue stems from improper validation of user-supplied input in the process of setting a custom logo for the app, which can be manipulated to achieve arbitrary file read, deletion, or overwrite, and to execute a DoS attack by deleting critical files required for the application's operation.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of CVE-2024-3166 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.6
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) cCVE-2024-3153 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
mintplex-labs/anything-llm is affected by an uncontrolled resource consumption vulnerability in its upload file endpoint, leading to a denial of service (DOS) condition. Specifically, the server can be shut down by sending an invalid upload request. An attacker with the ability to upload documents can exploit this vulnerability to cause a DOS condition by manipulating the upload request.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges CVE-2024-3150 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.8
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests to the endpoint `/workspace/:slug/thread/:threadSlug/update`. Specifically, the application fails to validate or check user input before passing it to the `workspace_thread` Prisma model for execution. This oversight allows attackers to craft a Prisma relation query operation that manipulates the `users` model to change a user's role to admin. Successful exploitation grants attackers the highest level of user privileges, enabling them to see and perform all actions within the system.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm.CVE-2024-3149 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.8
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest beforeCVE-2024-3110 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.7
A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at thCVE-2024-3102 · Other software · mintplex-labs · reported by security@huntr.devMedium 5.3
A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints.CVE-2024-3152 · Other software · mintplex-labs · reported by security@huntr.devHigh 8.8
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints. An attacker can exploit these vulnerabilities to escalate privileges from a default user role to an admin role, read and delete arbitrary files on the system, and perform Server-Side Request Forgery (SSRF) attacks. The vulnerabilities are present in the `/request-token`, `/workspace/:slug/thread/:threadSlug/update`, `/system/remove-logo`, `/system/logo`, and collector's `/process` endpoints. These issues are due to the application's failure to properly validate user input before passing it to `prisma` functions and other critical operations. Affected versions include the latest version prior to 1.0.0.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables.CVE-2024-3104 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.8
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 6, 2024An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes.CVE-2024-3033 · Other software · mintplex-labs · reported by security@huntr.devCritical 9.4
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 4, 2024A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intCVE-2024-4084 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.5
A Server-Side Request Forgery (SSRF) vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172, 10, and 127 through regular expressions and limit access protocols to HTTP and HTTPS, attackers can still bypass these restrictions using alternative representations of IP addresses and accessing other ports running on localhost. This vulnerability enables attackers to access any asset on the internal network, attack web services on the internal network, scan hosts on the internal network, and potentially access AWS metadata endpoints. The vulnerability is due to insufficient validation of user-supplied URLs, which can be exploited to perform SSRF attacks.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2024Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in theCVE-2024-4286 · Other software · mintplex-labs · reported by security@huntr.devMedium 4.9
Mintplex-Labs' anything-llm application is vulnerable to improper neutralization of special elements used in an expression language statement, identified in the commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. The vulnerability arises from the application's handling of user modifications by managers or admins, allowing for the modification of all existing attributes of the `user` database entity without proper checks or sanitization. This flaw can be exploited to delete user threads, denying users access to their previously submitted data, or to inject fake threads and/or chat history for social engineering attacks.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2024In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process.CVE-2024-4287 · Other software · mintplex-labs · reported by security@huntr.devHigh 7.2
In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to `/api/workspace/:workspace-slug/update`, allowing it to be executed as part of a database query without restrictions. This flaw enables users with a manager role to craft a request that includes nested write operations, effectively allowing them to create new Administrator accounts.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2024A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's `id` attribute to a value of 0CVE-2024-4284 · Other software · mintplex-labs · reported by security@huntr.devMedium 4.9
A vulnerability in mintplex-labs/anything-llm allows for a denial of service (DoS) condition through the modification of a user's `id` attribute to a value of 0. This issue affects the current version of the software, with the latest commit id `57984fa85c31988b2eff429adfc654c46e0c342a`. By exploiting this vulnerability, an attacker, with manager or admin privileges, can render a chosen account completely inaccessible. The application's mechanism for suspending accounts does not provide a means to reverse this condition through the UI, leading to uncontrolled resource consumption. The vulnerability is introduced due to the lack of input validation and sanitization in the user modification endpoint and the middleware's token validation logic. This issue has been addressed in version 1.0.0 of the software.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2024In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_dCVE-2024-36053 · Computers, phones & browsers · linuxmint · reported by MITRECritical 9
In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in check_connection, drop_data_received_cb, and Service.remove. A user can modify a service name in a ~/.linuxmint/mintUpload/services/service file.
- Product
- mintupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpackages.linuxmint.comgithub.com
May 6, 2024A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process.CVE-2024-2913 · Other software · mintplex-labs · reported by security@huntr.devMedium 6.5
A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user accounts from a single invite link intended for only one user. This bypasses the intended security mechanism that restricts invite acceptance to a single user, leading to unauthorized user creation without detection in the invite tab. The issue is due to the lack of validation for concurrent requests in the backend.
- Product
- mintplex-labs/anything-llm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2024Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability.CVE-2023-44452 · Computers, phones & browsers · Linux Mint · reported by zdi-disclosures@trendmicro.comHigh 7.8
Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.
- Product
- Xreader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
May 2, 2024Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability.CVE-2023-44451 · Computers, phones & browsers · Linux Mint · reported by zdi-disclosures@trendmicro.comHigh 7.8
Linux Mint Xreader EPUB File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of EPUB files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-21897.
- Product
- Xreader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comzerodayinitiative.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.