PT-2024-9243 · Documenso · Documenso

Name of the Vulnerable Software and Affected Versions: Documenso versions through 1.8.0 Documenso SaaS Hosted as of 2024-12-05 Description: The issue is related to the User Interface UI Misrepresentation of Critical Information in Documenso, allowing Content Spoofing. The displayed version does n...

CVE-2024-52269

User Interface UI Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04...

CVE-2024-52269

The CVE-2024-52269 entry (and related CVE-2024-52276) concerns DocuSign UI where hidden content rendered after signing can be misrepresented, enabling content spoofing. Technical details in connected sources show the issue affects DocuSign up to 2024-12-04 and involves a misrendering of layered c...

CVE-2024-52269 AI Assistant PDF Document Spoofing in DocuSign

User Interface UI Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04...

CVE-2024-52269 AI Assistant PDF Document Spoofing in DocuSign

User Interface UI Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This issue affects DocuSign: through 2024-12-04...

Sentry improper error handling leaks Application Integration Client Secret

Impact During routine testing, we identified a scenario where a specific error message generated by our platform could include a plaintext Client ID and Client Secret for an application integration. The Client ID and Client Secret would not be displayed in the UI, but would be returned in the...

PYSEC-2024-310

Sentry is an error tracking and performance monitoring platform. Version 24.11.0, and only version 24.11.0, is vulnerable to a scenario where a specific error message generated by the Sentry platform could include a plaintext Client ID and Client Secret for an application integration. The Client ...

CVE-2024-31141

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also...

CVE-2024-31141

CVE-2024-31141 affects Apache Kafka Clients (2.3.0–3.7.0, including 3.5.2 and 3.6.2) with ConfigProvider plugins that read from disk or environment variables via FileConfigProvider/DirectoryConfigProvider/EnvVarConfigProvider. The root cause is improper privilege management that allows untrusted ...

Microsoft Power Pages Misconfigurations Expose Millions of Records Globally

SaaS Security firm AppOmni has identified misconfigurations in Microsoft Power Pages that can lead to severe data breaches.…...

Comprehensive Guide to Building a Strong Browser Security Program

The rise of SaaS and cloud-based work environments has fundamentally altered the cyber risk landscape. With more than 90% of organizational network traffic flowing through browsers and web applications, companies are facing new and serious cybersecurity threats. These include phishing attacks, da...

CVE-2021-27701

SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery CSRF via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request...

CVE-2021-27700

SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc...

CVE-2021-27700

CVE-2021-27700 concerns the SOCIFI Guest wifi as SAAS portal, where insecure permissions allow any authorized customer in partner mode to switch to another customer dashboard and perform actions such as modifying or deleting users. CVSSv3.1 metrics indicate a Network attack vector, Low attack com...

CVE-2021-27701

The CVE-2021-27701 entry concerns SOCIFI Guest WiFi as a SAAS web portal affected by Cross-Site Request Forgery (CSRF). The underlying issue is the absence of a CSRF token and request validation, enabling an attacker to Add/Modify arbitrary user data via crafted CSRF requests. Public documents co...

PT-2024-10906 · Socifi · Socifi Guest Wifi

Name of the Vulnerable Software and Affected Versions: SOCIFI Socifi Guest wifi as SAAS wifi portal affected versions not specified Description: The issue concerns insecure permissions, allowing any authorized customer with partner mode to switch to another customer dashboard. This enables them t...

APSB24-90 : Security update available for Adobe Commerce

Adobe has released a security update for Adobe Commerce and Magento Open Source features powered by Commerce Services and deployed as SaaS software as a service. This update resolves a critical vulnerability. Successful exploitation could lead to arbitrary code execution...

CVE-2021-27701

SOCIFI Socifi Guest wifi as SAAS is affected by Cross Site Request Forgery CSRF via the Socifi wifi portal. The application does not contain a CSRF token and request validation. An attacker can Add/Modify any random user data by sending a crafted CSRF request...

CVE-2021-27700

SOCIFI Socifi Guest wifi as SAAS wifi portal is affected by Insecure Permissions. Any authorized customer with partner mode can switch to another customer dashboard and perform actions like modify user, delete user, etc...

Stop LUCR-3 Attacks: Learn Key Identity Security Tactics in This Expert Webinar

Did you know that advanced threat actors can infiltrate the identity systems of major organizations and extract sensitive data within days? It's a chilling reality, becoming more common and concerning by the day. These attackers exploit vulnerabilities in SaaS and cloud environments, using...