New vulnerabilities – clearly explained

Digitalbazaar Forge

Research and translation in progress – available shortly.

Digitalbazaar Forge

Research and translation in progress – available shortly.

Digitalbazaar Forge

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

joi: Denial of service via quadratic-time split in email multiple option

The joi validation library for Node.js is affected when the string().email({ multiple: true }) rule processes long runs of whitespace without a separator. An attacker who can submit a crafted value to such a field can cause one request to consume seconds of CPU time and block the Node.js event loop, which delays all other work in the application. The issue applies only where attacker-controlled input is validated with the multiple option and no effective length limit runs first; a .max() rule alone is not sufficient when abortEarly is set to false.

hapijs · joi

ServiceNow AI Platform: Cleartext storage of credentials in system table

A flaw in the ServiceNow AI Platform can cause a user's plaintext password, described by the CVE record as OAuth credentials, to be stored in a system table. A user who is not entitled to view the credential could read it there. The CVE record lists exposure as partial confidentiality impact, and CISA SSVC rates it as not automatable with no known exploitation.

ServiceNow · AI Platform

ServiceNow AI Platform: Sandbox escape in Rhino sandbox

ServiceNow AI Platform contains a sandbox escape in the Rhino sandbox. An authenticated user with the admin role can bypass the sandbox restrictions and execute arbitrary code on the underlying host operating system, which may enable further unintended access. Exploitation requires a valid admin session, not anonymous internet access. ServiceNow has deployed the fix to hosted instances and provided it to partners and self-hosted customers.

ServiceNow · AI Platform

OpenBMB XAgent: Directory traversal in ToolServer file upload

XAgent v1.0.0 contains a directory traversal vulnerability in the file upload handler of the ToolServer component (ToolServer/ToolServerNode/main.py). The CVSS 3.1 base score is 9.8 (critical), with network attack vector, low complexity, no privileges and no user interaction required. An attacker who can reach the ToolServer upload endpoint may be able to access or write files outside the intended directory, with high impact on confidentiality, integrity and availability.

OpenBMB · XAgent

SuperAGI: Incorrect access control in agent execution configuration endpoint

SuperAGI v0.0.14 does not check whether an agent and an agent execution belong to the requesting user's organization in the endpoint that returns agent execution configurations. An authenticated user from one organization can read another organization's configuration by supplying the agent_id and agent_execution_id of the victim. The reporter states that the configuration can contain sensitive data such as API keys and prompts, but this has not been verified. The attack requires a valid account on the same SuperAGI instance.

TransformerOptimus · SuperAGI

SuperAGI: Incorrect access control exposes other organisations' project data

SuperAGI v0.0.14 contains an improper access control flaw in the endpoint /agentexecutions/get/latest/agent/project/{project_id}. An authenticated user from one organisation can retrieve the latest execution and agent metadata of another organisation's project by supplying its project_id. The attack requires a valid account on the instance and network access to it, but no user interaction.

TransformerOptimus · SuperAGI

SuperAGI: Incorrect access control in agent project endpoint

SuperAGI up to version 0.0.14 does not verify that a project belongs to the requesting user's organisation on the endpoint /api/agents/get/project/{project_id}. An authenticated user of one organisation can therefore list the agents of another organisation's project, including their metadata and identifiers. The attacker needs a valid account and network access to the API; the impact is limited to confidentiality.

TransformerOptimus · SuperAGI

DB-GPT: Directory traversal in example file handling

DB-GPT versions 0.7.5 and 0.8.0 contain a directory traversal flaw in the use_example_file function of the examples API. The target path is built from the example name without validation, so a name containing traversal sequences can cause files to be written outside the user upload directory. The reporter describes arbitrary file writes that could lead to configuration tampering or code execution, which is not verified. Exploitation depends on the example name being manipulated, for example through configuration or database changes, and the reporter says authenticated access is needed, which conflicts with the CVSS vector.

eosphoros-ai · DB-GPT

Agent Zero: Directory traversal in file browser save_text_file

Agent Zero versions 1.7 to 1.10 do not validate user-supplied file paths in the File Browser method save_text_file. An attacker who can reach the web interface can write files to arbitrary locations on the host, which can overwrite system or configuration files or plant executables. The CVE record rates this as High (CVSS 7.5) with no authentication required, but the vector is inconsistent with the method's write function and should be verified in the NVD record.

agent0ai · Agent Zero

Botan: Integer overflow in FFI block size reporting can cause memory corruption

The Botan cryptography library reports the block size of a block cipher through its C API without checking for overflow when converting to int. An application that accepts external algorithm parameter strings and uses the FFI raw ECB mode can be tricked by an attacker into selecting the variable-block-size Lion cipher, leading to truncated size reporting, insufficient buffer allocation and memory corruption. The C++ API and commonly used C API modes such as CBC and CTR are not affected.

Botan Project · Botan

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Research and translation in progress – available shortly.

Nomad: Symlink following allows writes outside the allocation directory

HashiCorp Nomad and Nomad Enterprise follow symbolic links when writing dispatch payloads and executor logs. A user with job submission rights can use a malicious workload to create, overwrite or append to files outside the allocation directory. If the Nomad client agent runs as root, this can lead to code execution as root on the client host.

HashiCorp · Nomad

Research and translation in progress – available shortly.

SD JWT JS: Tampered disclosures silently dropped instead of rejected

SD JWT JS (@sd-jwt/core and @sd-jwt/decode) up to version 0.19.0 does not reject an SD-JWT presentation when a Disclosure has been tampered with or is malformed. The library silently drops the affected Disclosure and returns a reduced claim set without an error, although the Issuer signature remains valid. A malicious holder can thereby omit claims, and an on-path attacker can do the same if the relying party does not enforce key binding. If a verifier defaults to allowing access when a claim such as age or role is absent, this can change an authorization decision.

OpenWallet Foundation · SD JWT JS (@sd-jwt/core)

Centreon Web: Authenticated SQL injection in ACL management

Centreon Web, an open-source IT monitoring platform, contains an SQL injection flaw in its ACL management (Resources & Actions). An authenticated user with ACL management rights can read and modify the Centreon database. The attacker needs high privileges, so the main risk is a malicious or compromised administrator. The database stores monitoring configuration and credentials for monitored systems.

Centreon · Centreon Web

AWS Private CA Connector for Kubernetes: Incorrect authorization in issuer resolution

The issuer resolution logic in the AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 does not correctly enforce authorization. An authenticated user whose approval policy only permits a namespace-scoped issuer may obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer they are not authorized to use. The attack requires valid cluster credentials and low privileges.

Amazon Web Services · AWS Private CA Connector for Kubernetes

Botan: Insufficiently seeded random number generator in AutoSeeded_RNG

Botan is a C++ cryptography library. In versions 3.7.0 up to 3.13.0, AutoSeeded_RNG can mark itself as seeded without consulting the configured entropy source if an application clears the generator and then requests empty output while it is unseeded. On builds without a system RNG, later non-empty requests can then produce output from predictable state, which may weaken keys, nonces or tokens. The attack vector is local with low privileges, and exploitation is not known.

randombit · Botan

minimatch: Denial of service via amplification of glob parts

The npm package minimatch, which converts glob patterns into JavaScript RegExp objects, can be driven into excessive CPU and memory consumption during pattern compilation. A short, attacker-controlled glob pattern containing **/.. segments triggers repeated expansion at optimizationLevel 2 or higher. The impact is limited to availability, so a vulnerable application may become slow or crash.

isaacs · minimatch