Notwo1F

A weakness has been identified in nexmoe VidBee up to 1.3.13/2.0.2. The affected element is an unknown function of the file apps/desktop/src/main/local-api.ts of the component Local HTTP Service. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.2.0 is sufficient to fix this issue. This patch is called 141b8d39c1c11da4589264f814cee077df81e7f6. It is suggested to upgrade the affected component.

A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.

A flaw in the Local Agent Management Service allows remote attackers to cause a denial of service. The issue exists within the `stopAllBrowsers()` function located in the '/api/agent/browser/stopAll' endpoint.

A flaw in the Request Forwarder component allows remote attackers to perform server-side request forgery (SSRF), a technique where the attacker induces the server to make requests to an unintended location.

A flaw in the Request Forwarder component allows for information disclosure. This issue can be exploited by an attacker located within the local network.

A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file client-engine-application/w.cs of the component Cookie Controller. The manipulation of the argument guid results in information disclosure. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads to information disclosure. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the component Local HTTP Service. The manipulation results in missing authentication. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

A remote cross site scripting issue exists within the Renderer-Process IPC Bridge component. The flaw is located in the `clipboard.readText()` function within the `apps/electron/src/preload.ts` file. Cross site scripting is a technique where malicious scripts are injected into trusted websites or applications.

An issue exists in the Proxy Validation component within the `InternalController.TestProxy()` function of the `client-engine-application/f.cs` file. A remote attacker can manipulate the `host/port` argument to perform server-side request forgery, a technique where the attacker induces the server to make requests to an unintended location.

An issue in the Profile Controller component allows for information disclosure. The flaw exists within the `ListProfiles()` function located in the `client-engine-application/t.cs` file. This attack requires local environment access to be executed.

A command injection flaw exists in the Open Folder Endpoint component. A local attacker can manipulate the `path` argument passed to the `child process.exec()` function within the `src/routes/setting/fileManagement/openFolder.ts` file to execute arbitrary commands.

An issue exists in the Remotedev Server component where the `evalAction()` function fails to properly neutralize special elements in output data. By manipulating the `action` argument, a local attacker can perform code injection to execute arbitrary code and gain unauthorized access to protected information.

The issue allows an attacker who has control over the source/sink definition file in XML format to read files from external locations. This occurs when the XML-based format for sources and sinks is used and the attacker has control over the source/sink definition file. The vulnerability is related to an XML external entity (XXE) issue.