MetaGPT command injection vulnerability

MetaGPT is a multi-agent framework developed by MetaGPT Inc. Versions of MetaGPT 0.8.2 and earlier contained a command injection vulnerability. This vulnerability stemmed from the erroneous handling of the parameter mermaid.path in the function checkcmdexists found in the file...

cn.hutool:hutool-bom (4.6.7), cn.hutool:hutool-dfa (4.6.7) +2 more potentially affected by CVE-2023-42277 via cn.hutool:hutool-json (4.6.7)

cn.hutool:hutool-json MAVEN version 4.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-bom 4.6.7 - cn.hutool:hutool-dfa 4.6.7 - cn.hutool:hutool-http 4.6.7 - cn.virens:virens-utils-common...

cn.hutool:hutool-bom (4.6.7), cn.hutool:hutool-dfa (4.6.7) +2 more potentially affected by CVE-2023-42276 via cn.hutool:hutool-json (4.6.7)

cn.hutool:hutool-json MAVEN version 4.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-bom 4.6.7 - cn.hutool:hutool-dfa 4.6.7 - cn.hutool:hutool-http 4.6.7 - cn.virens:virens-utils-common...

cn.hutool:hutool-bom (4.6.1), cn.hutool:hutool-dfa (4.6.1) +28 more potentially affected by CVE-2022-45690 via cn.hutool:hutool-json (4.6.1)

cn.hutool:hutool-json MAVEN version 4.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-bom 4.6.1 - cn.hutool:hutool-dfa 4.6.1 - cn.hutool:hutool-http 4.6.1 - cn.virens:virens-utils-common...

cn.hutool:hutool-bom (4.6.7), cn.virens:virens-utils-common (1.4.1) potentially affected by CVE-2022-22885 via cn.hutool:hutool-http (4.6.7)

cn.hutool:hutool-http MAVEN version 4.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-http and may be impacted: - cn.hutool:hutool-bom 4.6.7 - cn.virens:virens-utils-common 1.4.1 Source cves: CVE-2022-22885 Source advisory:...

Remote Code Execution (RCE)

brooklyn-utils-common is vulnerable to remote code execution RCE attacks. The library by default allows the unmarshalling of Java types available to that classpath. This allows an attacker to inject and execute arbitrary code by passing a malicious yaml file to the application...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the REST server. An attacker can execute commands as the user by producing a malicious link that, if clicked while the user is logged in, exploits the server. PoC Attacker puts something like this int...

com.a9ski.brooklyn:apache-brooklyn-ldap-provider (1.0.0), eu.seaclouds-project:seaclouds-qa (1.0.0) +57 more potentially affected by CVE-2016-8737 via org.apache.brooklyn:brooklyn-utils-common (>=0.7.0-incubating, <=0.9.0)

org.apache.brooklyn:brooklyn-utils-common MAVEN version =0.7.0-incubating, =0.2.0, =0.2.0, =0.3.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =0.2.0, =0.8.0-incubating, =0.8.0-incubating, =0.8.0-incubating, =0.9.0 and more Source cves: CVE-2016-8737 Source advisory: SNYK:JAVA-ORGAPACHEBROOKLYN-99621...