Information Disclosure

github.com/clastix/capsule-proxy is vulnerable to Information Disclosure. The vulnerability is present in rolebindings.go which grants ServiceAccount tenant owners the privilege to list namespaces of other tenants that share the same owner kind and name. Consequently, this allows owners of...

PT-2023-8377 · Ibm · Ibm Qradar Siem

Name of the Vulnerable Software and Affected Versions: IBM QRadar SIEM version 7.5 Description: The issue is related to the lack of protection for service data in the IBM QRadar SIEM system, which can be exploited by a remote attacker to disclose protected information. Specifically, a delegated...

UBUNTU-CVE-2023-45807

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021. There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can perform create, edit...

PT-2023-7035 · Unknown +1 · Opensearch +2

Name of the Vulnerable Software and Affected Versions: OpenSearch versions prior to 1.3.14 OpenSearch versions prior to 2.11.0 Description: There is an issue with the implementation of tenant permissions in OpenSearch Dashboards where authenticated users with read-only access to a tenant can...

PT-2023-5579 · Cisco · Cisco Catalyst Sd-Wan Manager

Name of the Vulnerable Software and Affected Versions: Cisco Catalyst SD-WAN Manager affected versions not specified Description: The issue is related to insufficient user session management within the Cisco Catalyst SD-WAN Manager system, specifically in the multi-tenant feature. This could allo...

Midnight Blizzard conducts targeted social engineering over Microsoft Teams

Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard previously tracked as NOBELIUM. This latest attack, combined with past activit...

Keylime's registrar vulnerable to Denial-of-service attack via a single open connection

Impact Keylime registrar is prone to a simple denial of service attack in which an adversary opens a connection to the TLS port by default, port 8891 blocking further, legitimate connections. As long as the connection is open, the registrar is blocked and cannot serve any further clients agents a...

Information Disclosure

@saltcorn/cli is vulnerable to Information Disclosure. The vulnerability exists because it does not properly restrict unsafe plugins in subdomain tenants, which allows an admin authenticated attacker to install an unsafe plugin gain access to sensitive information from other tenants...

Wyse Management Suite Security Bypass Vulnerability

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A security bypass vulnerability exists in prior versions of Wyse Management Suite...

Dell Wyse Management Suite 授权问题漏洞

Wyse Management Suite is a scalable solution for managing and optimizing Wyse endpoints from Dell, USA. The product includes centralized management of Wyse endpoints, asset tracking and automated device discovery. A security bypass vulnerability exists in prior versions of Wyse Management Suite...

Global Retailers Must Keep an Eye on Their SaaS Stack

Brick-and-mortar retailers and e-commerce sellers may be locked in a fierce battle for market share, but one area both can agree on is the need to secure their SaaS stack. From communications tools to order management and fulfillment systems, much of today's critical retail software lives in SaaS...

Global Retailers Must Keep an Eye on Their SaaS Stack

Brick-and-mortar retailers and e-commerce sellers may be locked in a fierce battle for market share, but one area both can agree on is the need to secure their SaaS stack. From communications tools to order management and fulfillment systems, much of today's critical retail software lives in SaaS...

CVE-2023-30993

Summary of vulnerability (CVE-2023-30993) : IBM Cloud Pak for Security (CP4S) versions 1.9.0.0 through 1.9.2.0 are affected. A flaw could allow an attacker who has a valid API key for one tenant to access data from another tenant’s account, indicating a cross-tenant data exposure vulnerability. R...

CVE-2022-24631

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter...

CVE-2022-24631

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter...

PT-2023-12763 · Audiocodes · Audiocodes Device Manager Express

Name of the Vulnerable Software and Affected Versions: AudioCodes Device Manager Express versions through 7.8.20002.47752 Description: The issue is related to stored XSS via the desc parameter in the "ajaxTenants.php" endpoint. Recommendations: For AudioCodes Device Manager Express versions throu...

CVE-2023-33794

A stored cross-site scripting XSS vulnerability in the Create Tenants /tenancy/tenants/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

CVE-2023-33794

A stored cross-site scripting XSS vulnerability in the Create Tenants /tenancy/tenants/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Create Tenants /tenancy/tenants/ function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

NetBox 跨站脚本漏洞

NetBox is a Django, PostgreSql based tool for IP Address Management IPAM and Data Center Infrastructure Management DCIM from the NetBox community. A security vulnerability exists in NetBox version v3.5.1, which stems from a security issue in the Create Tenants /tenancy/tenants/ feature, and can b...