Shiyufan_Binyuan

A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.

A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.

An issue exists within the Sed Command Filter component where improper manipulation allows for OS command injection. This flaw enables remote attackers to execute arbitrary operating system commands on the affected system.

A flaw exists in the `spawn()` function of the Sandbox component. Manipulating the `Profile` argument allows an attacker to cause a sandbox issue, which can be executed on the local host.

A remote manipulation of the `agent()` function within the `dsh-workflow-worker-thread` component allows for the enforcement of a behavioral workflow.

A flaw exists in JingDong JD Cloud Box AX6600 that allows for remote privilege escalation. The issue is located within the `jdcweb rpc` component, specifically in the `web get ddns uptime` function of the `/jdcapi` file. Successful manipulation of this function can lead to unauthorized privilege escalation. The exploit for this issue has been publicly released. The vendor was notified but did not provide a response.

A flaw exists in JingDong JD Cloud Box AX6600. The issue is related to the `cast streen` function within the `jdcweb rpc` component, specifically in the file `/jdcapi`. Manipulation of the `File` argument can lead to Remote Privilege Escalation. The attack can be carried out remotely. The exploit for this issue has been publicly disclosed.

A flaw exists in JingDong JD Cloud Box AX6600 that could allow for remote privilege escalation. The issue resides within the `jdcapp rpc` component, specifically in the `/f/service/controlDevice` file and the `set stcreenen deabled status/get status` function. The attack can be initiated remotely, and a publicly available exploit exists. The vendor was informed of this issue but did not provide a response.