IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote attacker with a low-privileged authenticated account to bypass administrator-only restrictions and execute arbitrary code on the server. This occurs through manipulation of a built-in code-execution component using attacker-supplied inputs.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an authentication vulnerability that could allow a remote attacker to obtain sensitive information without authorization.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical vulnerability that allows a remote authenticated attacker to execute arbitrary code due to missing authorization controls. The flaw affects confidentiality, integrity, and availability with a high severity score of 9.9.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper limitation of a pathname to a restricted directory.
A missing authorization vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to partial confidentiality and integrity impacts without user interaction.
IBM Langflow OSS versions 1.0.0 through 1.12.4 have a vulnerability where sensitive information is stored in cleartext. This flaw allows a remote authenticated attacker to access sensitive data without requiring user interaction. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of code in eval/exec functions, leading to critical security risks including full system compromise.
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a vulnerability that allows a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code with unblocked patterns. This can lead to arbitrary operating system command execution on the server.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code due to improper control of code generation. This flaw has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a directory traversal vulnerability that allows an authenticated user to access arbitrary files on the system by sending a specially crafted URL request.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, potentially enabling network enumeration or aiding other attacks. The vulnerability has a CVSS 3.1 base score of 5.4, indicating medium severity.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a server-side request forgery (SSRF) vulnerability. An authenticated attacker could exploit this flaw to send unauthorized requests from the affected system, which may enable network enumeration or support further attacks. The vulnerability has a medium severity rating with a CVSS score of 4.3.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker with read or share permissions on a target flow to access the flow owner's stored third-party credentials in cleartext via the API response.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to obtain sensitive information by exploiting improper limitation of a pathname to a restricted directory. This vulnerability is identified as CWE-22 (Path Traversal).
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request. This flaw results in the loss of in-progress compute work and occurs due to the absence of flow-level permission checks.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to cause a denial of service by exploiting improper neutralization of special elements in OS commands. This flaw does not impact confidentiality or integrity but affects availability.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a vulnerability that allows a remote authenticated attacker to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, leading to command injection. The vulnerability has a high severity with a CVSS score of 8.8.
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a critical vulnerability that allows remote attackers to execute arbitrary code. This is due to improper neutralization of special elements used in operating system commands, classified under CWE-94. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
Share to Clipboard version 1.14.1 (versionCode 32) contains insecure permissions that allow unauthorized attackers to overwrite another user's clipboard content arbitrarily.