Skip to content
OpenAdvisories

Package · PyPI

dbgpt

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2024-10830

    Path Traversal in eosphoros-ai/db-gpt

    A Path Traversal vulnerability exists in the eosphoros-ai/db-gpt version 0.6.0 at the API endpoint `/v1/resource/file/delete`. This vulnerability allows an attacker to delete any file on the server by manipulating the `file_key` parameter. The `file_key` para…

    eosphoros-ai eosphoros-ai/db-gpt dbgpt PyPI
  • High 7.1
    CVE-2024-10906

    Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt

    In version 0.6.0 of eosphoros-ai/db-gpt, the `uvicorn` app created by `dbgpt_server` uses an overly permissive instance of `CORSMiddleware` which sets the `Access-Control-Allow-Origin` to `*` for all requests. This configuration makes all endpoints exposed by…

    eosphoros-ai eosphoros-ai/db-gpt dbgpt PyPI
  • High 7.5
    CVE-2024-10829 Public exploit

    Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt

    A Denial of Service (DoS) vulnerability in the multipart request boundary processing mechanism of eosphoros-ai/db-gpt v0.6.0 allows unauthenticated attackers to cause excessive resource consumption. The server fails to handle excessive characters appended to …

    eosphoros-ai eosphoros-ai/db-gpt dbgpt PyPI