CVE-2024-48919 RCE via Prompt Injection Into Cursor's Terminal Cmd-K

Cursor is a code editor built for programming with AI. Prior to Sep 27, 2024, if a user generated a terminal command via Cursor's Terminal Cmd-K/Ctrl-K feature and if the user explicitly imported a malicious web page into the Terminal Cmd-K prompt, an attacker with control over the referenced web...

CVE-2024-48919

CVE-2024-48919 affects Cursor, an AI-assisted code editor. Prior to 2024-09-27, if a user imported a malicious webpage into Cursor’s Terminal Cmd-K, an attacker controlling that page could influence a language model to emit arbitrary terminal commands when the user opts to include the page conten...

Cursor 输入验证错误漏洞

Cursor is an AI code editor from the Cursor open source. An input validation error vulnerability exists in versions prior to Cursor 20240927, which stems from the fact that if a user generates terminal commands via Cursor's Terminal Cmd-K/Ctrl-K functionality, an attacker could potentially...

PT-2024-33268 · Cursor · Cursor

Name of the Vulnerable Software and Affected Versions: Cursor versions prior to 0.42 Description: The issue allows an attacker with control over a malicious web page to influence a language model to output arbitrary commands for execution in the user's terminal. This scenario requires the user to...

CVE-2024-41997

An issue was discovered in version of Warp Terminal prior to 2024.07.18 v0.2024.07.16.08.02. A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the warp://action/docker/opensubshell intent that when clicked ...

CVE-2024-41997

CVE-2024-41997 affects Warp Terminal prior to 2024.07.18 (v0.2024.07.16.08.02). The Docker integration uses warp:// URIs and the /docker/open_subshell action accepts a shell parameter that is incorporated into a command string without sanitization, enabling command injection. An attacker can craf...

Warp 安全漏洞

Warp is a terminal application from Warp, Inc. A security vulnerability exists in versions prior to Warp 2024.07.18 v0.2024.07.16.08.02, which stems from a command injection vulnerability in the Docker Integration feature, which allows an attacker to execute commands on the victim's machine by...

CVE-2024-41997

An issue was discovered in version of Warp Terminal prior to 2024.07.18 v0.2024.07.16.08.02. A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the warp://action/docker/opensubshell intent that when clicked ...

CVE-2024-41997

An issue was discovered in version of Warp Terminal prior to 2024.07.18 v0.2024.07.16.08.02. A command injection vulnerability exists in the Docker integration functionality. An attacker can create a specially crafted hyperlink using the warp://action/docker/opensubshell intent that when clicked ...

Siemens HiMed Cockpit Alternate Path Improper Protection Vulnerability

The HiMed Cockpit is a multimedia terminal for infotainment and other applications, including supporting medical procedures at the bedside of hospital patients. Siemens HiMed Cockpit suffers from an improperly protected alternate path vulnerability that could be exploited by an unauthenticated,...

The vulnerability of the vt component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the vt component in the Linux operating system’s kernel is related to uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to cause a service failure...

SyroTech SY-GOPON-8OLT-L3 安全漏洞

The SyroTech SY-GOPON-8OLT-L3 is an optical line terminal from SyroTech. A security vulnerability exists in SyroTech SY-GOPON-8OLT-L3 version 1.6.0240629 that stems from the presence of an authenticated command injection vulnerability...

tmux: Null Pointer Dereference

Background tmux is a terminal multiplexer. Description A null pointer dereference issue was discovered in function windowpanesetevent in window.c in which allows attackers to cause denial of service or other unspecified impacts. Impact Manipulating tmux window state could result in a null pointer...

Cisco Catalyst Center Static SSH Host Key (cisco-sa-dnac-ssh-e4uOdASj)

The version of Cisco Catalyst Center formerly Cisco DNA Center installed on the remote host is prior to 2.3.5.6, 2.3.6.x, or 2.3.7.x prior to 2.3.7.5. It is, therefore, affected by a vulnerability in the SSH server that could allow an unauthenticated, remote attacker to impersonate a Cisco Cataly...

CVE-2024-20350

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

CVE-2024-20350 Cisco Catalyst Center Static SSH Host Key Vulnerability

A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An attacker could exploit this vulnerability...

`atty` is unmaintained

The maintainer of atty has published an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standard library's IsTerminal trait. Alternatives - std::io::IsTerminal - Stable since Rust 1.70.0 and the recommended replacement...

PT-2024-40922 · Atty +1 · Atty +1

Name of the Vulnerable Software and Affected Versions: atty affected versions not specified Description: The maintainer of atty has announced that the crate is no longer under development. Users are recommended to rely on the functionality in the standard library's IsTerminal trait instead...

kernel: vt_ioctl: fix array_index_nospec in vt_setactivate

A vulnerability was found in the Linux kernel's vtioctl subsystem, where the vtsetactivate function can lead to a transient integer underflow due to improper handling of the vsa.console value. The vulnerability arises when an out-of-bounds value is decreased before being sanitized using...

[SECURITY] Fedora 41 Update: jupyterlab-4.2.5-1.fc41

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface...