CVE Vulnerability Catalog

In langgenius dify up to 0.6.9, the get_api_tool_provider_remote_schema function in api/services/tools/api_tools_manage_service.py (ApiToolManageService component) is vulnerable to server-side request forgery via manipulation of the url argument. The attack can be initiated remotely and a public exploit exists. The vendor did not respond to the disclosure.

A security vulnerability has been detected in TransformerOptimus SuperAGI up to 0.0.14 affecting the extract_with_bs4/extract_with_3k/extract_with_lxml functions in superagi/helper/webpage_extractor.py of the WebScraperTool component. Manipulation leads to server-side request forgery. The exploit has been publicly disclosed and can be launched remotely.

ProjectDiscovery Nuclei 3 before 3.8.0 allows DSL expression injection. This affects the use of -env-vars for multi-step templates against untrusted targets (not the default configuration).

A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14 affecting the get_project/update_project/get_projects_organisation functions in superagi/controllers/project.py. Manipulation results in authorization bypass. The attack can be performed remotely and the exploit has been released publicly.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14 affecting the delete_agent/stop_schedule/get_schedule_data functions in superagi/controllers/agent.py. Manipulation of the agent_id argument leads to authorization bypass. The attack can be carried out remotely and the exploit is publicly available.

A vulnerability in TransformerOptimus SuperAGI up to 0.0.14 affects the get_agent_execution/update_agent_execution functions in superagi/controllers/agent_execution.py (Agent Execution Endpoint component). Manipulation of the agent_execution_id argument can lead to authorization bypass. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw was found in liangliangyy DjangoBlog up to 2.1.0.0 affecting the form_valid function in oauth/views.py. Manipulating the oauthid argument causes improper authorization, and the attack may be initiated remotely. The exploit has been published.

A vulnerability in lm-sys fastchat up to 0.2.36 affects the add_text function in the Arena Side-by-Side View Handler component. Manipulation leads to incorrect control flow. The attack can be performed remotely, and the exploit is publicly available. The root cause was fixed in commit 34eca62 for gradio_block_arena_named.py, but three other files were missed.

In lm-sys fastchat up to 0.2.36, the api_generate function in the Worker API Endpoint allows remote resource consumption. The exploit is publicly disclosed, and a patch (commit ff66426) missed other entry points.

A vulnerability has been found in Lagom WHMCS Template up to 2.4.2, affecting an unknown function of the Datatables component, leading to resource consumption. Remote exploitation is possible, and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.

SD-330AC and AMC Manager provided by silex technology, Inc. contain an improper neutralization of CRLF sequences ('CRLF Injection') vulnerability. Processing some crafted configuration data may lead to arbitrary entries injected to the system configuration.

SD-330AC and AMC Manager provided by silex technology, Inc. contain a reflected cross-site scripting vulnerability. When a user logs in to the affected device and visits a crafted web page, arbitrary script may be executed in the user's browser.

SD-330AC devices and AMC Manager provided by silex technology contain a missing authentication for critical function issue. The device configuration may be altered without authentication.

SD-330AC and AMC Manager from silex technology contain a heap-based buffer overflow in packet processing of sx_smpd. Processing a crafted packet may cause a temporary denial-of-service condition.

SD-330AC devices and AMC Manager provided by silex technology contain sensitive information in resources that are not removed before reuse. An attacker may log in to the device without knowing the password by sending a crafted packet.

SD-330AC and AMC Manager provided by silex technology, Inc. contain an issue with the use of a broken or risky cryptographic algorithm. Information in the traffic may be retrieved via a man-in-the-middle attack.

SD-330AC devices and AMC Manager from silex technology use a hard-coded cryptographic key. An administrative user may be directed to apply a fake firmware update.

SD-330AC devices and AMC Manager provided by silex technology contain a missing authentication for critical function issue on firmware maintenance. Arbitrary files may be uploaded to the device without authentication.

A server-side request forgery (SSRF) vulnerability has been discovered in the RAGAS library up to version 0.4.3 in the Collections module. The functions _try_process_local_file/_try_process_url in util.py improperly validate the retrieved_contexts argument, allowing a remote attacker to make requests to internal resources. The exploit has been published, and the vendor did not respond.

A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14 affecting the get_budget/update_budget functions in superagi/controllers/budget.py of the Budget Endpoint component. The manipulation leads to authorization bypass and can be exploited remotely. The exploit is publicly available and may be used; the vendor did not respond to the disclosure.