repository icon
danswer-ai / danswer Project repository

Gen-AI Chat for Teams - Think ChatGPT if it had access to your team's unique knowledge.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN42 DAYS

FIX

WITHINN/A DAYS

Session Management Vulnerability - Name Change Persists Post Logout
sharmaraghs
pending
IDOR in EE patch user group
r3jn
pending
SSRF on Danswer
samr301
spam
Denial of service by memory exhaustion
patrik-ha
High
•$450•CVE-2025-0182
Denial of Service due to chrome resource exhaustion
b0-n0-b0
spam
OS command injection
tuna18dv
informative
Critical
No authentication at `/api/manage/admin/doc-boosts` endpoint, revealing all the...
srivallikusumba
self closed
Password Management: Empty Password
anonaninda
spam
Insecure Randomness
anonaninda
spam
SSRF in many features
nduy2110
informative
Critical
SSRF in Add Connector features
nduy2110
duplicate
Critical
A basic user can create credentials and link them to an existing connector, lead...
mnqazi
Medium
•$75•CVE-2024-8057
CORS misconfiguration leads to data leak
srivallikusumba
duplicate
High
Misconfigured Danswer instances lead to the leaks of OpenAI API keys, AWS keys e...
mik0w
informative
High
Potential DoS via Unrestricted Folder Name Length, can be exploited remotely via...
mnqazi
duplicate
High
Unauthorized Access to Search Page Functions via API Despite Page Visibility Res...
fewword
Medium
•$75•CVE-2024-9612
Server-Side Template Injection (SSTI) in Chat Description Field
dan-xzero
not applicable
•CVE-2024-7805
Denial of Service in multipart/form-data while uploading a file in chat
srivallikusumba
High
•$450•CVE-2024-8028
Improper Access Control in Admin-User Chat Functionality.
dan-xzero
Medium
•$75•CVE-2024-7767
IDOR- allow view any file
fewword
Medium
•$75•CVE-2024-9617
Insufficient protection against enumeration of shared chats
dastaj
informative
High
CSRF leads to performing sensitive action in the context of the victim's browser...
dastaj
High
•$450•CVE-2024-8065
CORS misconfiguration leads to sensitive data leak
dastaj
High
•$450•CVE-2024-7819
SSRF through web connector
patrik-ha
informative
High
Arbitrary File Overwrite in ZulipConnector when zuliprc- direcetory exists
retr0reg
Critical
•$900•CVE-2024-7957
Redos (Regular Expression Denial of Service)
mvlttt
High
•$450•CVE-2024-7779