213 matches found
CVE-2026-0696
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values...
CVE-2026-0696
CVE-2026-0696 affects ConnectWise PSA: in versions older than 2026.1, certain session cookies were not set with HttpOnly. This could allow client-side scripts to access session cookie values, enabling potential exposure of session data. Affected software: ConnectWise PSA prior to 2026.1. Root cau...
CVE-2026-0696
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values...
CVE-2026-0696 Session Cookies Missing HttpOnly Attribute
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values...
CVE-2026-0696 Session Cookies Missing HttpOnly Attribute
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values...
CVE-2026-0695 Stored XSS in Time Entry Audit Trail
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected...
CVE-2026-0695
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content, which can allow stored script code to execute in the context of a user’s browser when the affected content is displayed. Affect...
CVE-2026-0695 Stored XSS in Time Entry Audit Trail
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected...
CVE-2026-0695: Improper Neutralization of Input During Web Page Generation
In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected...
CVE-2026-0696: Sensitive Cookie Without 'HttpOnly' Flag
In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values...
ConnectWise PSA security vulnerabilities
ConnectWise PSA is a professional service automation software developed by ConnectWise in the United States. Versions of ConnectWise PSA prior to 2026.1 contained security vulnerabilities. These vulnerabilities stemmed from the lack of output encoding for Time Entry notes in the Time Entry Audit...
ConnectWise PSA security vulnerabilities
ConnectWise PSA is a professional service automation software developed by ConnectWise in the United States. Versions of ConnectWise PSA prior to 2026.1 contained security vulnerabilities. These vulnerabilities stemmed from the lack of the HttpOnly attribute on certain session cookies, allowing...
PT-2026-3252
Name of the Vulnerable Software and Affected Versions ConnectWise PSA versions prior to 2026.1 Description Certain session cookies were not configured with the HttpOnly attribute in affected versions. This could potentially allow client-side scripts to access session cookie values. Recommendation...
CVE-2023-40271
In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software Interface is selected, and the Authenticated Encryption with Associated Data Chacha20-Poly1305 algorithm is used, with the single-part verification function...
The vulnerability of the ConnectWise PSA platform, related to information disclosure during data transmission, allows a perpetrator to gain unauthorized access to protected information or enhance their privileges.
The vulnerability of the ConnectWise PSA platform relates to the disclosure of information during data transmission. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information or enhance their privileges...
JLSEC-2025-232 Side channel in RSA key generation and operations (SSBleed, M-Step)
Vulnerability Mbed TLS's modular inversion routine and GCD routine are vulnerable to local timing attacks in a number of settings discussed below. These functions are used in RSA, making the following operations vulnerable in all configurations: - RSA key generation with any API mbedtlsrsagenkey...
PT-2025-48531
Vulnerability In symmetric encryption modes that involve padding, if an attacker can submit ciphertexts for decryption and learn whether the padding is valid, this provides partial information about the plaintext. If the attacker can also submit input that the victim encrypts together with a...
PT-2025-48514
In Mbed TLS before 3.1.0, psa aead generate nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...
PT-2025-48513
In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa cipher generate iv and psa cipher encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...