CWE-520 vulnerabilities

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain a misconfiguration vulnerability involving the use of impersonation. This flaw allows an attacker with limited privileges to reuse another user's FAISS namespace, leading to unauthorized access to owner-only vector content and the ability to influence subsequent query results. The vulnerability results in cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

.NET misconfiguration: use of impersonation vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Hijacking a Privileged Thread of Execution.This issue affects upKeeper Instant Privilege Access: through 1.5.0.