Wandb/Openui
Approved changes feed: RSS · Atom
cpe:2.3:a:wandb:wandb/openui:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wandb (ef876b63-f793-5951-a3b0-34c9ab6afa9f) |
|---|---|
| Product | Wandb/Openui (6f29493f-541b-5960-9937-826f03cf5fe1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-0192 |
vulnerable | 2026-06-08 07:00:29.898675 |
Stored Cross-site Scripting (XSS) in wandb/openui
MEDIUM (5.4)
A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, where an attacker can inject malicious scripts. When the modified HTML is shared with another user, the XSS payload executes, potentially leading to the theft of user prompt history and other sensitive information.
Published: 2025-03-20T10:10:22.264Z
Updated: 2025-03-20T18:22:32.167Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-10649 |
vulnerable | 2026-06-08 06:23:47.191172 |
Unauthenticated File Upload in wandb/openui
MEDIUM (6.1)
wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored XSS, and information disclosure. The affected endpoints are '/v1/share/{id:str}' for uploading and '/v1/share/{id:str}' for downloading JSON files. The lack of authentication allows any user to upload and overwrite files, potentially causing the S3 bucket to run out of space, injecting malicious scripts, and accessing sensitive information.
Published: 2025-02-10T18:50:27.106Z
Updated: 2025-10-15T12:50:10.025Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.