These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A server-side request forgery vulnerability has been identified in vas3k TaxHacker up to version 0.8.5. The issue is located in the testLLMProviderAction function within the app/(app)/apps/settings/actions.ts file. This vulnerability allows remote attackers to manipulate the provider, apiKey, model, and baseUrl arguments, potentially leading to unauthorized requests. The project has been informed but has [truncated]
A vulnerability was detected in vas3k TaxHacker up to 0.8.5. The function generateInvoicePDF of the file /apps/invoices/actions.ts of the component Invoice PDF Renderer is affected by server-side request forgery when manipulating the argument businessLogo. The attack can be carried out remotely. The exploit is now public and may be used. The project was informed early but has not responded yet.
A vulnerability was identified in vas3k TaxHacker up to 0.8.2, affecting the function envSchema.parse of the file lib/config.ts, which is part of the JWT Secret Handler component. The manipulation of the argument BETTER_AUTH_SECRET leads to hard-coded credentials. This issue can be exploited remotely. The project was informed early through an issue report but has not yet responded.
A vulnerability was determined in vas3k TaxHacker up to 0.8.2. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.