An insecure permissions vulnerability in rubenalfon Pile version 1.1.3 allows unauthorized attackers to invoke an exported component, which can lead to arbitrary data access and overwriting.
The wbpxre150 Shopping List application version 11.0 (versionCode 11) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to manipulation of the shopping-list data within the application.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or aiding other attacks. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, which may enable network enumeration or support further attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker with read or share permissions on a target flow to access the flow owner's stored third-party credentials in cleartext via the API response.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper limitation of a pathname to a restricted directory. This vulnerability is identified as CWE-22 (Path Traversal).
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request. This flaw results in the loss of in-progress compute work and occurs due to the absence of flow-level permission checks.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by exploiting improper neutralization of special elements in OS commands. This flaw does not impact confidentiality or integrity but affects availability.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in code, which can lead to code injection and execution.
CVE-2025-13050 is a vulnerability involving broken function level authorization that permits an authenticated user to execute poller post-restart commands. This flaw allows users with some level of access to perform actions beyond their intended permissions, potentially impacting system integrity and availability.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, leading to command injection. The vulnerability has a high severity with a CVSS score of 8.8.
Szafir versions prior to 2.0 build 708 accept any client or server certificate without validating the certificate or hostname. This allows HTTPS connections without authenticating the remote server, enabling an attacker to present arbitrary SSL/TLS certificates and potentially cause the application to download malicious update files from their server. The vulnerability is fixed in version 2.0 build 708.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, classified under CWE-94. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Share to Clipboard version 1.14.1 (versionCode 32) contains insecure permissions that allow unauthorized attackers to overwrite another user's clipboard content arbitrarily.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. This flaw could lead to high-impact integrity violations and limited availability impact. The vulnerability has a high severity score of 8.5 but no known exploits in the wild have been reported.
An insecure permissions vulnerability in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard mechanism, leading to desynchronization of the timing.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that allows a remote authenticated attacker to obtain sensitive information. The vulnerability requires authentication and does not impact integrity or availability. The CVSS score is 4.3, indicating a medium severity risk.
lz233 Tarnhelm version 1.8.2 (versionCode 20250630) contains insecure permissions that allow unauthorized attackers to invoke an exported component. This vulnerability can lead to arbitrary data access and overwriting by unauthorized parties.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability that could allow a remote authenticated attacker to obtain sensitive information. The vulnerability does not impact integrity or availability but can lead to information disclosure. The CVSS score is 5.0 (medium severity). No patch or remediation details are provided in the available data.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to create a server-generated ZIP archive with entry paths that traverse outside the intended extraction directory. If a victim extracts this archive using a tool that does not sanitize paths, it could lead to arbitrary file writes on the victim's system.