Privilege escalation

In onBindingDied of CallRedirectionProcessor.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitatio...

Design/Logic Flaw

In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-40130

CVE-2023-40130 affects Android’s CallRedirectionProcessor (notifyTimeout). The issue is a logic error allowing a local elevation of privilege with no extra execution privileges required and no user interaction. The documentation explicitly states the vulnerability as a permission bypass in the Ca...

CVE-2023-40116

In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

FAS - User is unable to launch desktops with Access Denied windows event

When attempting to launch desktop, Error message shows : "cannot start desktop". Event ID 1 and 28 are logged on Storefront servers. Application and service logs Citrix delivery services = Event ID: 1 Description: The Federated Authentication Server at: returned a server error: 1 for method...

CVE-2023-45811

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

Error "Unable to launch your application" When Launching Published Applications

Error "Unable to launch your application. Contact your help desk with the following information: Cannot connect to the Citrix XenApp server. The Network is down"When Launching Published Applications Through Citrix Gateway...

CVE-2023-25822 ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements

ReportPortal is an AI-powered test automation platform. Prior to version 5.10.0 of the com.epam.reportportal:service-api module, corresponding to ReportPortal version 23.2, the ReportPortal database becomes unstable and reporting almost fully stops except for small launches with approximately 1...

CVE-2023-41996

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6. Apps that fail verification checks may still launch...

Design/Logic Flaw

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.6. Apps that fail verification checks may still launch...

Unable to launch resources or Studio - connection between broker service and database has been lost

Users unable to launch resources such as published applications and desktops. Administrators unable to use Studio to manage environment. When checking event viewer logs on the DDC, we see event 1201 warning: When accessing the SQL Database, below error is see:...

Microsoft Error Reporting Local Privilege Elevation Exploit

This Metasploit module takes advantage of a bug in the way Windows error reporting opens the report parser. If you open a report, Windows uses a relative path to locate the rendering program. By creating a specific alternate directory structure, we can coerce Windows into opening an arbitrary...

DTLS handshake fails on DTLS1.0 even after DTLS is enabled on the SSL VPN VIP.

DTLS handshake fails with DTLS1.0 enabled the SSL VPN VIP causing App Launch Failure...

Fail to launch session with Event ID6 error after changing display setting.

Launch session takes 67 seconds and then fails. Check the Event Log, there are several Event ID 6 Errors recorded. Error Message: Citrix ICA could not configure Thinwire and switch to the remote ICA display. Rebooting the workstation or logging in to the console will fix this...

Design/Logic Flaw

In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

MyCrops HiGrade Security Vulnerability

MyCrops HiGrade is an app from MyCrops, Inc. It allows you to instantly test the quality of cannabis flowers directly from your cell phone. A security vulnerability exists in MyCrops HiGrade THC Testing and Cannabi version 1.0.337, which stems from a vulnerability that allows an attacker to launc...

App or Desktop disappears immediately after launch and session is left in Disconnected State

App or Desktop disappears immediately after launch and session is left in Disconnected State on Studio and the VDA...

Citrix FAS 12.1 -Unable to launch apps -access denied error on storefront servers

When launching Apps\Desktops user receives "Cannot Start App" or "Cannot start Desktop", and Errors/Warnings on StoreFront "Access Denied", Event ID 1 Error and Event ID 28 Warning...

ICA file not opening automatically instead it is downloading on browser on Double hop scenario

Every time an application is launched, it opens with a browser instead locally installed workspace app even though the native workspace app is the default selection...

New Variant of XLoader macOS Malware Disguised as 'OfficeNote' Productivity App

A new variant of an Apple macOS malware called XLoader has surfaced in the wild, masquerading its malicious features under the guise of an office productivity app called "OfficeNote." "The new version of XLoader is bundled inside a standard Apple disk image with the name OfficeNote.dmg,"...