47 matches found
askWAM
askWAM askWAM requests Microsoft Entra access tokens silently through Windows Web Account Manager WAM. It ships as a .NET Framework client, a standalone native x64 client, and an x64 Beacon Object File with a CNA command adapter. All frontends can enumerate accounts visible to the client and targ...
CVE-2022-45472
CVE-2022-45472 DOM Based XSS Software: CAE Learning Space Enterprise with Intuity License Image Version: 267r Patch Level: 639 Vulnerability: DOM Based XSS Description The CAE Learning Space Enterprise management software is vulnerable to a DOM Based XSS attack. A DOM Based XSS attack is when a...
EUVD-2022-48338
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2020-7664
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...
Linux Distros Unpatched Vulnerability : CVE-2020-7668
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...
Malicious code in @zalastax/nolb-cae (npm)
The package @zalastax/nolb-cae was found to contain malicious code...
MAL-2025-10853 Malicious code in @zalastax/nolb-cae (npm)
The package @zalastax/nolb-cae was found to contain malicious code...
CVE-2022-45472
CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...
CVE-2022-32748
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
Input validation
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
Spoofing
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
CVE-2022-32747
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
CVE-2022-32748
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
CVE-2022-32748
CVE-2022-32748 affects EcoStruxure™ Cybersecurity Admin Expert (CAE) versions prior to 2.2. Root cause: CWE-295 Improper Certificate Validation, which can cause CAE to present or process incorrect data to end users and may enable credential leakage, allowing an attacker to log into the configurat...
CVE-2022-32747: Authentication Bypass by Spoofing
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
CVE-2022-32748: Improper Certificate Validation
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
CAE LearningSpace Enterprise Cross-Site Scripting Vulnerability
CAE LearningSpace Enterprise is a clinical simulation management platform from CAE Canada, Inc. CAE LearningSpace Enterprise with Intuity License image 267r patch 639 contains a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data b...
CVE-2022-45472
CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...