repository icon
transformeroptimus / superagi Project repository

<⚡️> SuperAGI - A dev-first open source autonomous AI agent framework. Enabling developers to build, manage & run useful autonomous agents quickly and reliably.

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN14 DAYS

FIX

WITHINN/A DAYS

The unrestricted file names allow the Agent to perform arbitrary file writing
racerz-fighting
pending
The unrestricted file names allow the Agent to perform arbitrary file writing.
racerz-fighting
duplicate
Critical
The unrestricted file names allow the Agent to perform arbitrary file deletion.
racerz-fighting
pending
SSRF in SuperAGI
agentsec
informative
Critical
RCE in SuperAGI
agentsec
pending
XSS at Comments - Automate > Task
uonghoangminhchau
self closed
XSS at chat - I Assistant
uonghoangminhchau
self closed
Denial of service
oicu0619
duplicate
High
Password are stored in cleartext
codevigilanteofficial
informative
High
Wide Area IDOR
hainguyen0207
High
•$150•CVE-2024-12048
Abitrary file write via `resource upload` API
williwollo
duplicate
Critical
Remote code execution due to the insecure use of the eval function
williwollo
High
•$150•CVE-2024-9439
SSRF
codevigilanteofficial
duplicate
Critical
Leak of configuration that contains api key, etc
codevigilanteofficial
Medium
•$25•CVE-2024-9447
Path Traversal and Arbitrary File Upload Leading to Remote Code Execution
dtai261
duplicate
Critical
Leak of user information by register with same email
codevigilanteofficial
High
•$150•CVE-2024-10267
API Key Exposure Through Misconfigured Organization ID in User Registration
codevigilanteofficial
informative
Medium
Remote Code Execution via Arbitrary File Upload
souadsebaa
duplicate
Critical
SSRF via connecting a vector Database
alfinj0se
informative
High
Create large length model name lead to DoS UI
h2oa
informative
Medium
Data leak through CORS misconfiguration
h2oa
duplicate
High
Frameable response (potential Clickjacking)
h2oa
informative
Medium
Remote Code Execution due to Full Controled File Write
m0kr4n3
duplicate
Critical
Password are stored in cleartext
codevigilanteofficial
spam
Improper authorization lead to password change of any user
codevigilanteofficial
duplicate
High
Information exposure of credentials (cleartext password)
codevigilanteofficial
duplicate
Medium
Cross origin resource sharing allows interaction from arbitrary origin
lager1
spam
Ability to leak API keys, Update API keys due to misconfigured Auth & CORS leadi...
winters0x64
duplicate
Critical
Unauthenticated Denial of Service
mnqazi
High
•$150•CVE-2024-9437
Unrestricted File upload leads to overwrite any files/ create any type of files...
mnqazi
duplicate
Critical
CSRF in install agent_templates
hainguyen0207
informative
Medium
CORS can leads to create and steal an API_KEY.
mnqazi
duplicate
High
CORS misconfiguration leads to data leak
srivallikusumba
informative
Medium
User can account take over
kienzx203
Medium
•$25•CVE-2024-9431
The password is returned in the response, leading to account takeover.
ngductung
Medium
•$25•CVE-2024-9418
Path Traversal leads to RCE
ngductung
High
•$150•CVE-2024-9415
SSRF vulnerability in verify_end_point
aftersnows
informative
High