Daniel Teixeira

**Name of the Vulnerable Software and Affected Versions** Cursor versions prior to 2.5 **Description** A sandbox escape allows for remote code execution (RCE) when the AI agent autonomously performs Git operations. A malicious actor can hide scripts within hidden Git hooks in nested bare repositories or use prompt injection to write to improperly protected `.git` settings. When the AI agent executes routine commands, such as `git checkout`, these hooks are triggered automatically without user interaction, warnings, or prompts, leading to unauthorized code execution on the developer's machine. This issue is facilitated by the AI agent's ability to execute system-level commands and its interaction with the `Cursor Rules` file. **Recommendations** Update to version 2.5 or higher.

**Name of the Vulnerable Software and Affected Versions** NVIDIA Isaac Launchable (affected versions not specified) **Description** NVIDIA Isaac Launchable contains a flaw due to a hard-coded credential. Exploitation of this issue could allow an attacker to execute code, escalate privileges, cause a denial of service, and tamper with data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA Isaac Launchable (affected versions not specified) **Description** The software contains a flaw that could allow an attacker to trigger execution with unnecessary privileges. Exploitation of this issue may lead to code execution, privilege escalation, denial of service, information disclosure, and data tampering. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NVIDIA Isaac Launchable (affected versions not specified) **Description** NVIDIA Isaac Launchable contains a flaw where an attacker could trigger execution with unnecessary privileges. Exploitation of this issue could lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FTPShell Client (affected versions not specified) **Description** The issue is related to a buffer overflow in the FTP client. Exploitation of this issue may allow a remote attacker to execute arbitrary code or cause the application to crash by sending a specially crafted FTP server response with code 220. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Disk Savvy Enterprise version 10.4.18 **Description** A buffer overflow issue in the control protocol allows remote attackers to execute arbitrary code by sending a crafted packet to the TCP port 9124. **Recommendations** For Disk Savvy Enterprise version 10.4.18, consider restricting access to TCP port 9124 until a patch is available.

Name of the Vulnerable Software and Affected Versions: LabF nfsAxe version 3.7 Description: A buffer overflow issue exists in the FTP client of LabF nfsAxe, allowing remote FTP servers to execute arbitrary code via a long reply. Recommendations: For LabF nfsAxe version 3.7, update to a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** SyncBreeze versions prior to 10.6 DiskSorter versions prior to 10.6 DiskBoss versions prior to 8.9 DiskPulse versions prior to 10.6 DiskSavvy versions prior to 10.6 DupScout versions prior to 10.6 VX Search versions prior to 10.6 **Description** A buffer overflow issue in the Import Command allows attackers to execute arbitrary code via a crafted XML file containing a long name attribute of a `classify` element. **Recommendations** For SyncBreeze versions prior to 10.6, update to version 10.6 or later. For DiskSorter versions prior to 10.6, update to version 10.6 or later. For DiskBoss versions prior to 8.9, update to version 8.9 or later. For DiskPulse versions prior to 10.6, update to version 10.6 or later. For DiskSavvy versions prior to 10.6, update to version 10.6 or later. For DupScout versions prior to 10.6, update to version 10.6 or later. For VX Search versions prior to 10.6, update to version 10.6 or later.