PT-2025-26194 · Versa · Versa Director

Name of the Vulnerable Software and Affected Versions: Versa Director SD-WAN orchestration platform affected versions not specified Description: The Versa Director SD-WAN orchestration platform has a Webhook feature that can be abused by an authenticated user to send crafted HTTP requests to...

The vulnerability of the SD-WAN Versa Concerto automation and orchestration platform lies in the improper assignment of permissions for critical resources during the signature verification process. This allows attackers to execute arbitrary code and increase their privileges.

The vulnerability of the SD-WAN Versa Concerto automation and orchestration platform lies in the improper assignment of permissions for critical resources during the signature verification process. Exploiting this vulnerability allows attackers to execute arbitrary code and enhance their privileg...

Salt 安全漏洞

Salt is an automation, infrastructure management, data-driven orchestration, and remote execution application from the Salt project. A security vulnerability exists in Salt that stems from the failure to clean up the input value jid in the main pubret method, which could lead to a denial of servi...

DaaS-Hosting-Failed to update the master image associated with the provisioning scheme.

While changing Master Image in AWS throwing an error "Failed to update the master image associated with the provisioning scheme." Export of error details: Transaction ID: xxxxxxxxxxxxxxxxx Action Name: MCUpdateMachineCatalog Exception: StudioErrorId : ProvisioningTaskError ErrorCategory :...

Zero-Trust Foundation Models: a New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things

This paper focuses on Zero-Trust Foundation Models ZTFMs, a novel paradigm that embeds zero-trust security principles into the lifecycle of foundation models FMs for Internet of Things IoT systems. By integrating core tenets, such as continuous verification, least privilege access LPA, data...

CVE-2023-2530

A privilege escalation allowing remote code execution was discovered in the orchestration service...

CVE-2010-1965

Unspecified vulnerability in HP Insight Orchestration for Windows before 6.1 allows remote attackers to read or modify data via unknown vectors...

CVE-2010-4104

Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to read arbitrary files via unknown vectors...

CVE-2010-4105

Unspecified vulnerability in HP Insight Orchestration before 6.2 allows remote attackers to bypass intended access restrictions, and obtain sensitive information or modify data, via unknown vectors...

CVE-2025-34026: Authentication Bypass Using an Alternate Path or Channel

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The internal Actuator endpoint can be leveraged for access to heap dumps and trace logs.This issue is kno...

CVE-2025-34025: Incorrect Permission Assignment for Critical Resource

The Versa Concerto SD-WAN orchestration platform is vulnerable to an privileges escalation and container escape vulnerability caused by unsafe default mounting of host binary paths that allow the container to modify host paths. The escape can be used to trigger remote code execution or direct hos...

Towards Centralized Orchestration of Cyber Protection Condition (CPCON)

The United States Cyber Command USCYBERCOM Cyber Protection Condition CPCON framework mandates graduated security postures across Department of Defense DoD networks, but current implementation remains largely manual, inconsistent, and error-prone. This paper presents a prototype system for...

Citrix Virtual Apps and Desktops - Unable to create/update catalog in Hyper-V Environment

When admin tries to create or update machine catalog, there is an error message displayed in Studio. Error details: Failed to update the master image associated with the provisioning scheme because the configuration validating is not successful. If you check the details: StudioErrorId :...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-43862 Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

CVE-2025-43862: Improper Access Control

Dify is an open-source LLM app development platform. Prior to version 0.6.12, a normal user is able to access and modify APP orchestration, even though the web UI of APP orchestration is not presented for a normal user. This access control flaw allows non-admin users to make unauthorized access a...

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in versions of dify prior to 0.6.12, which stems from an access control flaw that could lead to unauthorized access and modification of APP orchestration by non-administrative...

From Searching in the Dark to Seeing Ahead With Hive Pro’s Enhanced BAS

Running short on time but still want to stay in the know? Well, we’ve got you covered! We’ve condensed all the key takeaways into a handy audio summary. Our AI-driven podcasts are fit for on the go. Click right here to hear it all on Hive Pro's Enhanced BAS! During a recent incident response, I...

RHEL 6 : openstack-heat and security advisory (Moderate) (RHSA-2016:0440)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0440 advisory. OpenStack Orchestration heat is a template-driven engine used to specify and deploy configurations for Compute, Storage, and OpenStack Networking. It...

The vulnerability of the Splunk App for SOAR software lies in its insecure management of privileges, allowing attackers to elevate their privileges.

The vulnerability of the Splunk App for SOAR software relates to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...