CVE-2024-3033 Improper Authorization in mintplex-labs/anything-llm

An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes. This flaw allows unauthenticated users to perform destructive actions on the VectorDB, including resetting the database and deleting specifi...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a business-compliant document chatbot. A cross-site scripting vulnerability exists in AnythingLLM that stems from the application's ability to fetch content from a website and embed it in the workspace, which can be exploited to execute arbitrary JavaScript code...

PT-2024-24122 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: A vulnerability exists in the thread update process, allowing users with Default or Manager roles to escalate their privileges to Administrator. This issue arises from...

typo3 Information Disclosure Security Note

Due to reports it has been validated that internal workspaces in Neos are accessible without authentication. Some users assumed this is a planned feature but it is not. A workspace preview should be an additional feature with respective security measures in place. Note that this only allows readi...

GHSA-G4XV-R3QW-V3Q2 typo3 Information Disclosure Security Note

Due to reports it has been validated that internal workspaces in Neos are accessible without authentication. Some users assumed this is a planned feature but it is not. A workspace preview should be an additional feature with respective security measures in place. Note that this only allows readi...

GHSA-V5JP-4H2P-J2P4 Privilege Escalation in TYPO3 CMS

The workspace/ version preview link created by a privileged backend user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability...

Privilege Escalation in TYPO3 CMS

The workspace/ version preview link created by a privileged backend user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability...

[SECURITY] Fedora 40 Update: kf5-frameworkintegration-5.115.0-3.fc40

Framework Integration is a set of plugins responsible for better integration of Qt applications when running on a KDE Plasma workspace. Applications do not need to link to this directly...

Trackpad on the latest Magic Keyboards for iPad Pro M4 is not compatible with the CWA for iOS

The trackpad on the latest Magic Keyboards for the new iPad Pro M4 11-inch and 13-inch is currently not compatible with the Citrix Workspace app on iOS...

RHEL 7 : kde-workspace (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kde-workspace: arbitrary code execution and local privilege escalation CVE-2014-8651 - kde-workspace 4.2....

UBUNTU-CVE-2024-36041

KSmserver in KDE Plasma Workspace aka plasma-workspace before 5.27.11.1 and 6.x before 6.0.5.1 allows connections via ICE based purely on the host, i.e., all local connections are accepted. This allows another user on the same machine to gain access to the session manager, e.g., use the...

CWA 2402 - Microsoft Teams VDI plugin is not shown for Non-Admin user

When installing Citrix Workspace app 2402 LTSR for Windows CWA or later version with Administrator privileges, all the three Add-ons single sign-on, App Protection, Microsoft Teams VDI plugin are shown. But if installing CWA 2402 with non-admin user, all the three Add-ons are not shown...

RHEL 6 : kde-workspace (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - kde-workspace: X11 clients can eavesdrop input events while screen is locked CVE-2015-1308 Note that Nessus has not...

Fedora 40 : plasma-workspace (2024-83fc86a0bc)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-83fc86a0bc advisory. CVE-2024-36041 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Fedora 39 : plasma-workspace (2024-d120dc28b8)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d120dc28b8 advisory. CVE-2024-36041 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

plasma[56]-plasma-workspace -- Unauthorized users can access session manager

David Edmundson reports: KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE based purely on the host, allowing all local connections. This allows another user on the same machine to gain access to the session manager. A well crafted client could use the session restore feature ...

InstallEmbeddedBrowser=N param is not honored by CWA 2403

The installation process for Citrix Workspace App for Windows 2403 is unable to honor command line parameters correctly, causing Citrix Enterprise Browser CEB to be installed even when the switch “InstallEmbeddedBrowser” is set to “N” Example : CitrixWorkspaceApp.exe /silent InstallEmbeddedBrowse...

CVE-2024-36118 Unauthorized viewing of workspace test cases in MeterSphere

MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There...

RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability

The threat actors behind the RedTail cryptocurrency mining malware have added a recently disclosed security flaw impacting Palo Alto Networks firewalls to its exploit arsenal. The addition of the PAN-OS vulnerability to its toolkit has been complemented by updates to the malware, which now...

MeterSphere 安全漏洞

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. A security vulnerability exists in versions prior to MeterSphere 2.10.15-lts that stems from allowing users without workspace privileges to view functional test cases in other workspaces that exceed their...