Dem0000

**Name of the Vulnerable Software and Affected Versions** CherryHQ cherry-studio versions prior to 1.9.7 **Description** Improper authorization exists in the MCP OAuth Local Callback Server component within the `src/main/services/mcp/oauth/callback.ts` file. A remote attacker can manipulate the `code` argument to bypass authorization. This attack is characterized by high complexity and difficult exploitability. **Recommendations** Update to a version newer than 1.9.6. As a temporary mitigation, restrict access to the MCP OAuth Local Callback Server component.

**Name of the Vulnerable Software and Affected Versions** CherryHQ cherry-studio versions prior to 1.9.8 **Description** An authorization bypass exists in the CherryIN Preload API component. A remote attacker can bypass authorization by manipulating the `state` argument within the `sha256()` function located in the `src/main/services/memory/MemoryService.ts` file. The attack complexity is high and exploitability is considered difficult. **Recommendations** Update to a version newer than 1.9.7. As a temporary mitigation, restrict access to the `sha256()` function in the `src/main/services/memory/MemoryService.ts` file.

**Name of the Vulnerable Software and Affected Versions** DeepMyst Mysti version 0.4.0 **Description** An improper authorization issue exists within the Contact Tracking component. The flaw is located in the ` isTrackedConversation()` function of the `src/managers/ChannelBridge.ts` file. A remote attacker can exploit this by manipulating the ` channelType` argument. The attack requires a high degree of complexity and is considered difficult to execute. **Recommendations** Install patch 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48 for version 0.4.0. As a temporary mitigation, restrict access to the ` isTrackedConversation()` function.

**Name of the Vulnerable Software and Affected Versions** xiaozhi-esp32 versions prior to 2.2.7 **Description** A weakness in the MCP Response Handler component allows for improper synchronization. This issue occurs within the `ParseMessage()` function located in the `main/mcp server.cc` file. Remote exploitation is possible, although the attack complexity is rated as high and exploitation is considered difficult. **Recommendations** Update xiaozhi-esp32 to a version newer than 2.2.6. As a temporary mitigation, restrict access to the `ParseMessage()` function within the MCP Response Handler component.

**Name of the Vulnerable Software and Affected Versions** xiaozhi-esp32 versions prior to 2.2.7 **Description** A remote denial of service can be triggered through the manipulation of the `session id` argument. This issue resides within the `Application::GetInstance()` function located in the `main/protocols/mqtt protocol.cc` file of the MQTT Goodbye Handler component. The attack complexity is high and exploitability is considered difficult. **Recommendations** Apply patch e182471f8c5a22434346bd98da34d3b66c8c8b3e to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** AIDC-AI ComfyUI-Copilot versions prior to 2.0.29 **Description** A flaw exists in the Workflow Checkpoint Restore Handler component within the file `backend/controller/conversation api.py`. This issue involves improper control of resource identifiers, which can be exploited remotely. The attack is characterized by high complexity and is considered difficult to execute. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.