3 results · Clear filters · Feed
-
Medium 6.1
Agent Zero < 1.15 Stored XSS via image_get API Endpoint
Agent Zero before version 1.15 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript in the application origin by serving SVG files through the image_get API endpoint without Content-Security-Policy, X-Cont…
-
Medium 6.3
frdel/agent0ai agent-zero document_query.py handle_pdf_document server-side request forgery
A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remot…
-
Medium 4.3
frdel/agent0ai agent-zero files.py get_abs_path path traversal
A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The exploit has …