MeterSphere security vulnerabilities

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. A security vulnerability exists in versions prior to MeterSphere 2.10.15-lts that stems from allowing users without workspace privileges to view functional test cases in other workspaces that exceed their...

PT-2024-26904 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.10.15-lts Description: The issue allows users without workspace permissions to view functional test cases of other workspaces beyond their authority. Recommendations: For versions prior to 2.10.15-lts, upgrade ...

Unable to add store to Citrix Workspace App for Windows when Forcepoint agent is installed

When adding a StoreFront store to Citrix Workspace App for Windows, the Google multi-factor authentication page does not load correctly if Forcepoint agent is installed. The authentication form only partially loads. Without Forcepoint agent, the problem disappears...

PT-2024-34097 · Citrix · Citrix Workspace App For Mac

Name of the Vulnerable Software and Affected Versions: Citrix Workspace app for Mac affected versions not specified Description: The issue concerns a problem with Citrix Workspace app for Mac. There is no information about the estimated number of potentially affected devices worldwide or details...

Citrix Workspace app for Mac Security Bulletin for CVE-2024-5027

A vulnerability has been discovered in Citrix Workspace app for Mac, which, if exploited, may result in elevation of privilege from a local authenticated user to a root user. Affected Versions: The following supported versions of Citrix Workspace app for Mac are affected by the vulnerability:...

PT-2024-40277 · Silverstripe · Silverstripe 4 +4

Name of the Vulnerable Software and Affected Versions: silverstripe/comments module affected versions not specified cwp/starter-theme affected versions not specified cwp/watea-theme affected versions not specified SilverStripe 4 versions prior to 4.2.0 CWP versions prior to 2.0.0 Description: The...

Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

GHSA-CW5R-JX8R-9F7X Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

CVE-2024-5273

The Jenkins Report Info Plugin (version 1.2 and earlier) is vulnerable to a path traversal vulnerability due to a lack of path validation when serving report files. Attackers with Item/Configure permission can manipulate the workspace path to retrieve sensitive data from the controller file syste...

Path traversal vulnerability in report-info

report-info 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, report-info does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permission to retrieve Surefire...

PT-2024-35422

Name of the Vulnerable Software and Affected Versions Jenkins Report Info Plugin versions 1.2 and earlier Description The issue arises from the lack of path validation of the workspace directory while serving report files, leading to a path traversal vulnerability. This allows attackers with...

CVE-2024-5273: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

Jenkins plugins Multiple Vulnerabilities (2024-05-24)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing...

Launch failures after upgrading to CWA 2402

Users on Citrix Workspace App for Windows 2402 and have Real-Time Media Engine RTME installed on endpoint devices older than 2.9.700 may encounter session launch failures...

CVE-2024-4287

In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to "/api/workspace/:workspace-slug/update", allowing it to be executed as part o...

CVE-2024-4287 Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update process. Specifically, the application fails to validate or format JSON data sent in an HTTP POST request to /api/workspace/:workspace-slug/update, allowing it to be executed as part of ...

CVE-2024-4287

In mintplex-labs/anything-llm, a vulnerability exists due to improper input validation in the workspace update flow. The flaw occurs when JSON data sent via HTTP POST to /api/workspace/:workspace-slug/update is not properly validated/formatted, allowing the payload to be executed as part of a dat...