Browse All

A flaw in Microsoft 365 Copilot's permission settings allows someone with authorized access to improperly view sensitive information across a network. The issue stems from incorrect assignment of permissions (access rules) to a critical resource (important data or system component), meaning the AI tool isn't properly restricting who can see what.

vLLM (a software framework for running large language models) versions up to 0.29.0 has a memory cleanup bug in its decode workers (specialized processors that handle the generation phase of AI inference). Attackers can exploit this by sending requests with max_tokens=0 (asking for zero output tokens), which prevents the system from properly clearing temporary data, eventually consuming all available memory until the worker crashes and restarts.

Microsoft 365 Copilot's Business Chat has a vulnerability where special characters are not properly filtered before being used in commands, allowing attackers to inject malicious commands (command injection, where an attacker sneaks unauthorized instructions into a system by exploiting how it processes input). This could let unauthorized people access and steal sensitive information across the network.

Azure Machine Learning contains a vulnerability where authorization checks (the system that verifies whether a user is allowed to perform an action) are not working correctly, allowing an attacker without permission to access and steal sensitive information over the internet.

AI Agent Automation, a platform for managing AI workflows with scheduling and monitoring tools, has a vulnerability in versions before 0.9.1 where authenticated users can manipulate file paths to escape the intended workspace directory and read sensitive files or overwrite files that the application can access. The vulnerability occurs because the system doesn't verify that file paths stay within approved directories after resolving them.

AI Agent Automation, a platform that runs automated AI workflows (sequences of actions controlled by AI), had a security flaw in versions before 0.9.1 where three memory functions (listMemories, deleteMemory, and clearAgentMemory) didn't properly verify that an authenticated attacker (someone who had valid login credentials) actually owned the data they were accessing. This meant an attacker could read, delete, or clear another user's conversation history and agent data if they knew that user's identifiers, breaking the isolation between different users' data.

SQLBot is a system that converts natural language questions into SQL database queries using AI and RAG (retrieval-augmented generation, where external data sources help the AI answer questions). Before version 1.9.0, the system failed to safely handle user-supplied table names when building SQL queries, allowing authenticated attackers to use special PostgreSQL functions to read sensitive files like /etc/passwd (which contains user account information) and configuration files, potentially exposing secrets and source code.

SQLBot, a system that converts natural language questions into database queries using AI and external data retrieval, had a security flaw before version 1.9.0 where authenticated users could upload SVG image files with embedded malicious code. When other users viewed these images, the malicious code would run in their browser session, potentially allowing attackers to steal data or perform actions on behalf of victims (this vulnerability is called stored cross-site scripting, where harmful code is saved and executed later).