CVE-2023-45703

HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion...

Input validation

HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion...

CVE-2023-45700 HCL Launch is susceptible to an HTML injection vulnerability

HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure...

CVE-2023-45700

CVE-2023-45700 affects HCL Launch where an HTML injection flaw exists in the Web UI. The root cause is insufficient input sanitization/escaping in the UI, allowing an attacker to embed arbitrary HTML, potentially leading to disclosure of sensitive information. Affected product: HCL Launch (Web UI...

HCL Technologies HCL Launch Cross-Site Scripting Vulnerability

HCL Technologies HCL Launch is a versatile, enterprise-grade continuous delivery automation software from HCL Technologies, Inc. for handling the most complex deployment processes in DevOps. A security vulnerability exists in HCL Launch that stems from a vulnerability that allows an attacker to...

CVE-2023-45703

CVE-2023-45703 affects HCL Launch. The issue is improper input validation of uploaded archive files, causing resource exhaustion and denial of service. The root cause is mishandling input validation in the archive upload process. Impact is described as high for availability; exploitation details ...

CVE-2023-45703 HCL Launch is susceptible to a Denial of Service vulnerability

HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion...

PT-2023-29656 · Hcl · Hcl Launch

Name of the Vulnerable Software and Affected Versions: HCL Launch affected versions not specified Description: The issue is related to the mishandling of input validation of an uploaded archive file, which can lead to a denial of service due to resource exhaustion. Recommendations: At the moment,...

The ICA file will be downloaded when launching resources in browser

The ICA file may be downloaded when launching the resource from a browser...

HCL Technologies HCL Launch Security Breach

HCL Technologies HCL Launch is a versatile, enterprise-grade continuous delivery automation software from HCL Technologies, Inc. for handling the most complex deployment processes in DevOps. A security vulnerability exists in HCL Launch that stems from improper validation of uploaded files, which...

PT-2023-29653 · Hcl · Hcl Launch

Name of the Vulnerable Software and Affected Versions: HCL Launch affected versions not specified Description: The issue allows a user to embed arbitrary HTML tags in the Web UI, potentially leading to sensitive information disclosure. This is due to an HTML injection vulnerability...

dockerspawner Security Vulnerabilities

dockerspawner is a tool for spawning JupyterHub single-user servers in Docker containers. A security vulnerability exists in dockerspawner version 0.11.0 up to and including version 13.0, which stems from allowing a user to launch any image that can be pulled, rather than being limited to a singl...

End-to-End Encrypted Instagram and Messenger Chats: Why It Took Meta 7 Years

Mark Zuckerberg personally promised that the privacy feature would launch by default on Messenger and Instagram chat. WIRED goes behind the scenes of the company’s colossal effort to get it right...

Prevent ICA downloads when initiating a hybrid launch

ICA files contain the information to connect to a resource so must be handled securely. In some situations when the user uses a web browser to launch into Citrix Workspace app installed locally hybrid launch, the browser downloads an .ica file rather than keeping it in-memory, which allows it to ...

CVE-2023-40095

In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40079

In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-45777

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2023-40095

In createDontSendToRestrictedAppsBundle of PendingIntentUtils.java, there is a possible background activity launch due to a missing check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40079

In injectSendIntentSender of ShortcutService.java, there is a possible background activity launch due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-27267 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: The issue is related to a missing check in the createDontSendToRestrictedAppsBundle function of PendingIntentUtils.java, which could lead to a possible background activity launch. This migh...