Threat database

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability where a remote authenticated attacker can overwrite arbitrary files due to improper limitation of pathnames to restricted directories. This flaw allows unauthorized file modification but does not impact confidentiality or availability directly. The vulnerability has a medium severity rating with a CVSS score of 6.5.

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication vulnerability (CWE-287) that allows remote attackers to bypass security restrictions. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability is rated critical with a CVSS score of 9.8.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability is identified as CWE-918 and has a medium severity rating with a CVSS score of 5.0. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in code generation, classified as CWE-94. The vulnerability has a high severity with a CVSS score of 8.8.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability (CWE-78) where improper neutralization of special elements in OS commands can allow a remote authenticated attacker to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.3 (medium severity).

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability and requires authentication to exploit.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability where an authenticated attacker can create a server-generated ZIP archive with paths that traverse outside the intended extraction directory. If a victim extracts this archive using a tool that does not sanitize paths, it could lead to arbitrary file writes on the victim's system.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker with a read or share grant on a target flow to retrieve the flow owner's stored third-party credentials in cleartext from the API response.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or aiding other attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability due to deserialization of untrusted data. This flaw could allow a remote attacker with access to the message broker to execute arbitrary code on the affected system. The vulnerability is identified as CWE-502 and has a high severity rating with a CVSS score of 8.1.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability involving deserialization of untrusted data that could allow a remote authenticated attacker to execute arbitrary code. This flaw is identified as CWE-502 and has a high severity with a CVSS score of 8.8.

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or other attacks. The vulnerability has a medium severity rating with a CVSS score of 5.4. No public exploits or patches are currently documented.

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability (CWE-78) that allows a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements in OS commands. This flaw can lead to full compromise of confidentiality, integrity, and availability of the affected system.