Vendor
Sipeed
14 known vulnerabilities.
Products
11 results · Clear filters · Feed
-
Medium 5.6
Sipeed PicoClaw First Run Setup access_control.go authentication bypass
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. The impacted element is an unknown function of the file web/backend/middleware/access_control.go of the component First Run Setup. Performing a manipulation of the argument allowed_cidrs results in …
-
Medium 6.3
Sipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation leads to missing author…
-
Medium 6.3
Sipeed PicoClaw web_fetch web.go isPrivateOrRestrictedIP server-side request forgery
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Impacted is the function isPrivateOrRestrictedIP of the file pkg/tools/integration/web.go of the component web_fetch. This manipulation causes server-side request forgery. The attack can be initia…
-
Medium 6.3
Sipeed PicoClaw Group Message wecom.go dispatchIncoming authorization
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This issue affects the function dispatchIncoming of the file pkg/channels/wecom/wecom.go of the component Group Message Handler. The manipulation results in incorrect authorization. It is pos…
-
Medium 5.3
Sipeed PicoClaw context.go NewContextBuilder inclusion of functionality from untrusted control sphere
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation leads to inclusion of functionality from untrusted control sphere. The attack needs to be…
-
Medium 5.3
Sipeed PicoClaw LINE Webhook line.go webhook.ParseRequest authentication replay
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LINE Webhook. The manipulation results in authentication bypass by capture-replay. The at…
-
Medium 5.3
Sipeed PicoClaw pipeline_execute.go ExecTool.executeRun toctou
A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manipulation of the argument cwe leads to time-of-check time-of-use. The attack must be carr…
-
Medium 4.3
Sipeed PicoClaw auth.go cross-site request forgery
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched remotely. The exploit h…
-
Medium 5.4
Sipeed PicoClaw pico.go rt.ReloadConfig authorization
A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Performing a manipulation of the argument message.send results in missing authorization. It is possible…
-
Medium 6.3
Sipeed PicoClaw MQTT Channel mqtt.go authorization
A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Affected by this issue is some unknown functionality of the file pkg/channels/mqtt/mqtt.go of the component MQTT Channel Handler. This manipulation of the argument client_id causes incorrect autho…
-
Medium 6.3
Sipeed PicoClaw Guarded Web Fetch Flow web.go WebFetchTool.Execute server-side request forgery
A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. Affected by this vulnerability is the function WebFetchTool.Execute of the file pkg/tools/integration/web.go of the component Guarded Web Fetch Flow. The manipulation results in server-side r…