SRC-2022-0005 : VMware Workspace ONE Access customError.ftl Server-side Template Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within the customError.ftl template. The issue results from...

SRC-2022-0008 : VMware Workspace ONE Access ApplicationSetupController dbTestConnection JDBC Injection Remote Code Execution Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on affected installations of VMware Workspace ONE Access. Authentication is required to exploit this vulnerability. The specific flaw exists within ApplicationSetupController class. The issue results from...

SRC-2022-0006 : VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass Vulnerability

Vulnerability Details: This vulnerability allows remote attackers to bypass authentication on affected installations of VMware Workspace ONE Access. Authentication is not required to exploit this vulnerability. The specific flaw exists within OAuth2TokenResourceController class. The issue results...

screen sharing on applications (Teams, WebEx and GoToMeeting) will not display screen properly until Workspace is minimized.

screen sharing on applications Teams, WebEx and GoToMeeting will not display screen properlyblack screen until Workspace is minimized...

SRC-2022-0011 : VMware Workspace ONE Access gatherConfig.hzn Privilege Escalation Vulnerability

Vulnerability Details: This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workspace ONE Access. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...

CVE-2022-23104

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directo...

CVE-2022-23104 WIN-911 2021 Incorrect Default Permissions

WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the program Operator Workspace directory, which holds DLL files and executables. A low-privilege attacker could write a malicious DLL file to the Operator Workspace directo...

Terraform Enterprise May Capture Sensitive Data In Logs

Summary Terraform Enterprise was configured to log inbound HTTP requests in a manner that may capture sensitive data. This vulnerability, CVE-2022-25374, was fixed in Terraform Enterprise v202202-1. Background Terraform Enterprise TFE is an application that helps teams use Terraform together, wit...

Vulnerability fixed in VMWare Workspace ONE

VMWare has fixed a vulnerability in Workspace ONE for iOS. A malicious party could potentially exploit the vulnerability for a Cross-Site Scripting Attack XSS. Because workspace ONE is an application for accessing enterprise email, calendars and contact information on BYOD, it could potentially...

VMware Workspace ONE Boxer update addresses a stored cross-site scripting (XSS) vulnerability (CVE-2022-22944)

3a. VMware Workspace ONE Boxer update addresses a stored cross-site scripting XSS vulnerability CVE-2022-22944 VMware Workspace ONE Boxer contains a stored cross-site scripting XSS vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum...

Vmware Workspace One Boxer 跨站脚本漏洞

Vmware Workspace One Boxer is a mobile email application for AirWatch and Workspace One customers from Vmware USA. VMWare Workspace ONE Boxer suffers from a cross-site scripting vulnerability that stems from user-supplied data not being adequately processed. An attacker could exploit the...

Win-911 安全漏洞

Win-911 is a security software from the American company Win-911. It is used for industrial equipment alarm security. A security vulnerability exists in WIN-911 2021 that stems from a misconfiguration of permissions in the product, which could allow an attacker to exploit the vulnerability to wri...

Mattermost: Invitation Email is resent as a Reminder after invalidating pending email invites

An issue was found in Mattermost's workspace invite system that allowed unwanted users to join a workspace, leading to potential information disclosure. The vulnerability was caused by the lack of an option to cancel an invite, which could be exploited by an attacker to join a workspace even if t...

4 best practices to implement a comprehensive Zero Trust security approach

Today’s threat actors don’t see barriers, they see opportunities. As the old firewalls protecting the corporate network become obsolete amid the rush to adopt a hybrid workspace, implementing Zero Trust security has become an imperative across all sectors, both public and private. During this tim...

GHSA-7W2W-FWPF-9M4H Jenkins Pipeline: Deprecated Groovy Libraries Plugin Protection Mechanism Failure

Jenkins Pipeline: Deprecated Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same workspace directory for all checkouts of Pipeline libraries with the same name regardless of the SCM being used and the source of the library configuration. This allows attackers with Item/Configure...

The vulnerability of the IBM Planning Analytics and IBM Planning Analytics Workspace software lies in the incorrect limitation of the path name to the restricted access catalog, allowing a perpetrator to execute arbitrary code.

The vulnerability of IBM Planning Analytics’ software is related to incorrect restrictions on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Incoming audio issue on Microsoft Teams optimization for CWA Chrome OS

Any user on optimized Microsoft Teams is not able to receive any incoming audio during audio or video calls. Video streaming is not impacted. Users who meet the below conditions are likely to see the issue are on Citrix Workspace app for Chrome OS AND have enabled Microsoft Teams optimization...

Incoming audio issue on Microsoft Teams optimization for CWA HTML5

Any user on optimized Microsoft Teams is not able to receive any incoming audio during audio or video calls. Video streaming is not impacted. Users who meet below conditions are likely to see the issue are on Citrix Workspace app for HTML5 AND have enabled Microsoft Teams optimization...

8x8 Bounty: jaas.8x8.vc: Removed users can still have READ/WRITE access to the workspace via different API endpoints

An improper access control vulnerability was discovered in jaas.8x8.vc, where removed users could still have READ/WRITE access to the workspace via different API endpoints, if they were logged in and saved their session cookies. The issue was resolved by fixing the session management...

Session getting lost after few minutes if Citrix Workspace App for iOS is not running in the foreground

When launching a VDI session from an iOS device, if Citrix Workspace App for iOS CWA is not always on the front, then the session will be disconnected and lost after 5 minutes. End users would have to download a new ICA file again...