Erichen

**Name of the Vulnerable Software and Affected Versions** nextlevelbuilder GoClaw versions prior to 3.13.3 **Description** An incorrect authorization issue exists in the WebSocket Approval Endpoint. A remote attacker can manipulate the `RequestApproval()` function within the `internal/tools/exec approval.go` file to bypass authorization mechanisms. **Recommendations** Update nextlevelbuilder GoClaw to version 3.13.3 or later. As a temporary mitigation, restrict access to the WebSocket Approval Endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** nextlevelbuilder GoClaw versions prior to 3.13.3 **Description** Improper authorization occurs within the `isSafeBin()` function located in the internal/tools/exec approval.go file. This flaw allows a remote attacker to bypass authorization checks through manipulation. **Recommendations** Update nextlevelbuilder GoClaw to version 3.13.3 or later. As a temporary mitigation, restrict access to the `isSafeBin()` function in the internal/tools/exec approval.go file.

**Name of the Vulnerable Software and Affected Versions** nextlevelbuilder GoClaw versions prior to 3.13.3-beta.4 **Description** A remote manipulation of the `matchesAllowlist()` and `extractBin()` functions within the `internal/tools/exec approval.go` file can lead to an incorrectly-resolved name. **Recommendations** Update nextlevelbuilder GoClaw to version 3.13.3-beta.4 or later. As a temporary workaround, restrict access to the `matchesAllowlist()` and `extractBin()` functions to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** poco-ai poco-claw versions prior to 0.5.7 **Description** A flaw in the executor manager API component allows for missing authentication. This occurs within the `create task()` function located in the `executor manager/app/api/v1/tasks.py` file. An attacker can perform a manipulation to bypass authentication requirements. **Recommendations** Upgrade to version 0.5.7. As a temporary mitigation, restrict access to the `create task()` function in the `executor manager/app/api/v1/tasks.py` file.

**Name of the Vulnerable Software and Affected Versions** poco-ai poco-claw versions prior to 0.5.5 **Description** A server-side request forgery (SSRF) exists in the `run task()` function within the file `executor/app/api/v1/task.py`. This issue allows a remote attacker to trigger unauthorized requests by manipulating the `callback url` argument. SSRF is a flaw where an attacker can force a server to make requests to an unintended location. **Recommendations** Update poco-ai poco-claw to version 0.5.5 or later. As a temporary mitigation, restrict or validate the input provided to the `callback url` argument in the `run task()` function.

**Name of the Vulnerable Software and Affected Versions** mosaxiv clawlet versions prior to 0.2.11 **Description** Remote attackers can exploit a missing authorization flaw in the cron Chat Tool component. The issue resides in the `list/remove` function within the `tools/tool cron.go` file, allowing unauthorized manipulation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.22 Apache Tomcat versions 10.1.0-M1 through 10.1.55 Apache Tomcat versions 9.0.0.M1 through 9.0.118 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109 **Description** Cross-Site Scripting (XSS) occurs in the number guess example application due to improper neutralization of script-related HTML tags in a web page. XSS is a flaw that allows an attacker to inject malicious scripts into content delivered to other users. **Recommendations** Upgrade versions 11.0.0-M1 through 11.0.22 to 11.0.23. Upgrade versions 10.1.0-M1 through 10.1.55 to 10.1.56. Upgrade versions 9.0.0.M1 through 9.0.118 to 9.0.119.

**Name of the Vulnerable Software and Affected Versions** Node.js versions prior to 26.3.1-1.1 **Description** Security issues were identified in Node.js that could compromise server infrastructure. **Recommendations** Update to version 26.3.1-1.1.

**Name of the Vulnerable Software and Affected Versions** OpenStack Keystone versions prior to 29.0.2 **Description** The federated token rescoping mechanism fails to propagate the original token's expiry to the newly issued token. When a federated user rescopes a token through the 'POST /v3/auth/tokens' endpoint, the `handle scoped token()` function in the mapped authentication plugin returns response data lacking an `expires at` value. Consequently, the token provider issues a token with a fresh default Time To Live (TTL). This allows users to maintain indefinite access by repeatedly rescoping tokens before they expire, bypassing configured token lifetime policies. This issue only affects deployments utilizing federated identity, such as SAML2 or OpenID Connect. **Recommendations** Update to version 29.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Commons versions 2.2 through 2.14.x **Description** An uncontrolled recursion issue exists when processing untrusted configuration files. Specifically, the software throws a StackOverflowError—a runtime error that occurs when the call stack exceeds its allocated memory—when handling YAML input containing cycles. **Recommendations** Upgrade to version 2.15.0.

**Name of the Vulnerable Software and Affected Versions** OpenStack Ironic versions prior to a3f6d73 **Description** An infinite loop can occur during image handling when checksum calculations are performed using the 'file:///dev/zero' URL. **Recommendations** Update to version a3f6d73 or later.

**Name of the Vulnerable Software and Affected Versions** OpenStack Horizon versions 25.6 through 25.7.2 OpenStack Horizon versions 25.7 through 25.7.2 **Description** A write operation occurs in the session storage backend before authentication, allowing unauthenticated requests to exhaust the storage. Specifically, the login view stores a post-login redirect URL in the server-side session before the user is authenticated, which can be exploited to cause a session flood. **Recommendations** Update to version 25.7.3.