Threats Tagged 'cwe-520'

IBM Langflow OSS versions 1.0.0 through 1.10.1 have a vulnerability that allows an attacker with limited privileges to access another user's private vector documents by creating a flow with matching Chroma persist_directory and collection_name values. This unauthorized access exposes the victim's exact content in the attacker's workflow output. Additionally, the attacker can insert documents into the victim's collection, potentially polluting the victim's data. The vulnerability does not require user interaction but does require some level of privilege to create flows.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a misconfiguration vulnerability involving the use of impersonation. This flaw allows an attacker with limited privileges to reuse another user's FAISS namespace, leading to unauthorized access to owner-only vector content and the ability to influence subsequent query results. The vulnerability results in cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.