| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network. |
| The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mechanize::HTTP::Agent#response_follow_meta_refresh when Mechanize#follow_meta_refresh is enabled. A page containing a meta refresh to another origin causes headers configured through Mechanize#request_headers= to be reapplied to the refresh request, allowing an attacker who controls content in the crawl to capture bearer tokens or session cookies. The default configuration is not affected because follow_meta_refresh is false, and the exposure is limited to caller-supplied default headers. This issue is fixed in version 2.14.1. |
| Improper link resolution before file access ('link following') in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally. |
| Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally. |
| Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. |
| Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
| Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
| Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. |
| Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
| Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to disclose information locally. |
| Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. |
| Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally. |
| Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. |
| Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally. |
