Disclosed vulnerabilities Gecko found in open-source and commercial software, with the analysis and the fix.
Authorization bypass in n8n’s dynamic-credentials OAuth endpoints allows any authenticated user to operate on another user’s OAuth credential by supplying its ID, enabling unauthorized OAuth rebinding and revocation.
Artemiy Malyshau
An IDOR vulnerability in n8n’s public variables API allows authenticated users to read project variables outside their authorized scope, exposing secrets across project boundaries.
Artemiy Malyshau
Authentication bypass in n8n’s StripeTrigger node allows unauthenticated attackers to forge arbitrary Stripe webhooks without knowing the signing secret.
Artemiy Malyshau
Path traversal vulnerability in n8n’s Webhook node allows attackers to write files to arbitrary locations on remote servers connected via SSH.
Artemiy Malyshau
Server-side request forgery vulnerability in BentoML’s file upload processing system allowing arbitrary HTTP requests from the server.
Artemiy Malyshau
Authorization bypass vulnerability in AutoGPT’s external API allowing authenticated users to access execution results from other users’ graph executions.
Artemiy Malyshau
Arbitrary file copy vulnerability in Gradio’s flagging feature allows unauthenticated attackers to copy any readable file from the server’s filesystem.
Artemiy Malyshau
Authentication flow vulnerability in Ollama’s model pulling mechanism allowing cross-domain token redirection and theft.
Artemiy Malyshau
Authorization bypass vulnerability in ONYX Enterprise Edition allowing curators to manipulate groups outside their authorized scope.
Artemiy Malyshau
Local file inclusion vulnerability in Dagster’s gRPC server allowing arbitrary file reading through path traversal in notebook data endpoint.
Artemiy Malyshau
Remote code execution vulnerability in Letta’s tool execution endpoint through unsafe Python code execution in inadequate sandbox.
Artemiy Malyshau
Stored cross-site scripting vulnerability in AIM Reports allowing malicious Python code to execute arbitrary JavaScript in users’ browsers.
Artemiy Malyshau
Arbitrary file overwrite vulnerability in ONNX library’s save_external_data function through path traversal attacks.
Artemiy Malyshau
SQL injection vulnerability in DB-GPT 0.7.0 despite fixes for prior CVEs, affecting multiple database endpoints.
Artemiy Malyshau
Remote code execution vulnerability in DB-GPT’s plugin upload functionality through unsafe Python code execution.
Artemiy Malyshau
Stored cross-site scripting vulnerability in Ragflow’s dialog configuration functionality allowing malicious HTML/JavaScript execution.
Artemiy Malyshau
A path traversal vulnerability was found in AIM server. This vulnerability allows remote attackers to write arbitrary files on the server’s filesystem via a malicious tar file extraction.
Artemiy Malyshau
Remote code execution vulnerability in SuperAGI through unsafe eval() usage in agent template configuration processing.
Artemiy Malyshau
Arbitrary file overwrite vulnerability in SuperAGI’s file upload functionality due to insufficient path sanitization.
Artemiy Malyshau