Filtered by vendor Mintplexlabs
Subscriptions
Total
30 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-3033 | 1 Mintplexlabs | 1 Anythingllm | 2024-11-21 | 9.4 Critical |
| An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specific namespaces, without requiring any authorization or permissions. The issue affects all versions up to and including the latest version, with a fix introduced in version 1.0.0. Exploitation of this vulnerability can lead to complete data loss of document embeddings across all workspaces, rendering workspace chats and embeddable chat widgets non-functional. Additionally, attackers can list all namespaces, potentially exposing private workspace names. | ||||
| CVE-2024-22422 | 1 Mintplexlabs | 1 Anythingllm | 2024-11-21 | 7.5 High |
| AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit `08d33cfd8` an unauthenticated API route (file export) can allow attacker to crash the server resulting in a denial of service attack. The “data-export” endpoint is used to export files using the filename parameter as user input. The endpoint takes the user input, filters it to avoid directory traversal attacks, fetches the file from the server, and afterwards deletes it. An attacker can trick the input filter mechanism to point to the current directory, and while attempting to delete it the server will crash as there is no error-handling wrapper around it. Moreover, the endpoint is public and does not require any form of authentication, resulting in an unauthenticated Denial of Service issue, which crashes the instance using a single HTTP packet. This issue has been addressed in commit `08d33cfd8`. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-0879 | 1 Mintplexlabs | 1 Vector Admin | 2024-11-21 | 6.5 Medium |
| Authentication bypass in vector-admin allows a user to register to a vector-admin server while “domain restriction” is active, even when not owning an authorized email address. | ||||
| CVE-2023-5833 | 1 Mintplexlabs | 1 Anythingllm | 2024-11-21 | 8.8 High |
| Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. | ||||
| CVE-2023-5832 | 1 Mintplexlabs | 1 Anythingllm | 2024-11-21 | 9.1 Critical |
| Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0. | ||||
| CVE-2023-4899 | 1 Mintplexlabs | 1 Anything-llm | 2024-11-21 | 8.8 High |
| SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | ||||
| CVE-2023-4898 | 1 Mintplexlabs | 1 Anything-llm | 2024-11-21 | 7.5 High |
| Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | ||||
| CVE-2023-4897 | 1 Mintplexlabs | 1 Anythingllm | 2024-11-21 | 9.8 Critical |
| Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. | ||||
| CVE-2024-7783 | 2 Miniplex Labs, Mintplexlabs | 2 Miniplex Labs\/anything Lim, Anythingllm | 2024-10-31 | 7.5 High |
| mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3. | ||||
| CVE-2024-3279 | 1 Mintplexlabs | 1 Anythingllm | 2024-08-12 | N/A |
| An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of the existing `anythingllm.db` file. By exploiting this vulnerability, attackers can serve malicious data to users or collect information about them. The vulnerability stems from the application's failure to properly restrict access to the data-import functionality, allowing unauthorized database manipulation. | ||||