Eric-E

**Name of the Vulnerable Software and Affected Versions** nextlevelbuilder GoClaw versions prior to 3.13.3-beta.4 **Description** A remote information disclosure issue exists within the `handleNavigate()` function located in the pkg/browser/tool.go file. This occurs when the `args.targetUrl` argument is manipulated, allowing an attacker to expose sensitive information. **Recommendations** Update to version 3.13.3-beta.4 or later. As a temporary mitigation, restrict access to the `handleNavigate()` function.

**Name of the Vulnerable Software and Affected Versions** zhayujie chatgpt-on-wechat CowAgent versions prior to 2.1.2 **Description** A server-side request forgery (SSRF) exists in the Vision Tool component. This occurs when the `image` argument is manipulated within the `Vision. download to data url()` function located in the `agent/tools/vision/vision.py` file. This flaw allows a remote attacker to initiate unauthorized requests from the server. **Recommendations** Update to version 2.1.2. As a temporary mitigation, restrict access to the `Vision. download to data url()` function.

**Name of the Vulnerable Software and Affected Versions** louisho5 picobot versions prior to 0.2.1 **Description** A weakness in the Workspace Handler component allows remote attackers to perform link following. This issue occurs within the `CreateSkill()` and `GetSkill()` functions located in the `internal/agent/tools/filesystem.go` file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `CreateSkill()` and `GetSkill()` functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QuantumNous new-api versions prior to 0.12.2 **Description** A SQL injection flaw exists in the 'self' Endpoint within the `model/topup.go` file. The issue is located in the `SearchUserTopUps()` and `SearchAllTopUps()` functions, allowing a remote attacker to manipulate queries via SQL injection, which is a technique where malicious SQL statements are inserted into entry fields for execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QuantumNous new-api versions prior to 0.12.2 **Description** An issue in the Midjourney Image Relay Endpoint component, specifically within the `RelayMidjourneyImage/GetByOnlyMJId()` function located in the `router/relay-router.go` file, allows for a remote authorization bypass. This bypass occurs through manipulation of the function, although the attack is characterized by high complexity and difficult exploitability. **Recommendations** Update to a version later than 0.12.1. As a temporary workaround, restrict access to the `RelayMidjourneyImage/GetByOnlyMJId()` function to minimize the risk of exploitation.