| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network. |
| The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1. |
| Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. |
| Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally. |
| Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally. |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network. |
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. |
| Insertion of sensitive information into log file in Windows Kernel-Mode Drivers allows an authorized attacker to disclose information locally. |
| Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
| Files or directories accessible to external parties in Windows Event Viewer allows an authorized attacker to disclose information over a network. |
| Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
