Improper access control

Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value in work space...

PT-2022-20264

Name of the Vulnerable Software and Affected Versions PersonaManagerService versions prior to SMR Jun-2022 Release 1 Description The issue is related to improper handling of insufficient permissions in the addAppPackageNameToAllowList function within the PersonaManagerService. This allows local...

CVE-2022-30727: Improper Handling of Insufficient Permissions or Privileges

Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value in work space...

Samsung mobile 安全漏洞

Samsung mobile is a cell phone from Samsung South Korea. Samsung mobile PersonaManagerService is vulnerable to an authorization issue that stems from improper permission management in addAppPackageNameToAllowList, which can be exploited by local attackers to A local attacker can use the...

Exploit for Server-Side Request Forgery in Vmware Workspace_One_Uem_Console

CVE-2021-22054 Generate SSRF payloads References https:/...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...

Supply Chain Attack

npm is vulnerable to supply chain attack. The vulnerability exists due to the lack of verification root-level workspace path...

GHSA-7M9H-V68W-PFW3 Neos CMS vulnerable to XSS in various backend modules

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

Unable to load settings with Global App Config Service on Citrix Workspace app Chrome OS/HTML5

If the administrator has rolled out any settings via Global App Config Service and a user launches the Citrix Workspace app, it may happen that the settings rolled out previously by the administrator may not be applied. If the administrator now tries to roll out any new settings via Global App...

CVE-2022-30429

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

CVE-2022-30429

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

Packing does not respect root-level ignore files in workspaces

Impact npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published...

PT-2022-20114 · Neos Cms · Neos Cms

Name of the Vulnerable Software and Affected Versions: Neos CMS versions 3.3.29 through 8.0.1 Description: Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion o...

CVE-2022-30429: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

Exploit for Code Injection in Vmware Identity_Manager

CVE-2022-22954 PoC VMware Workspace ONE Access and Identity M...

Authentication Bypass Vulnerability in Multiple VMware Products

VMware vRealize Automation is a management tool that provides self-service, supervisory multi-cloud automation.VMware Workspace One Access is a centralized management console through which you can manage users and groups, set and manage authentication and access policies, and add resources to the...

How to Add process Management black/White list on WEM

...

PT-2022-28256

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue concerns the notification module, which fails to properly escape HTML from the server, leading to potential XSS vulnerabilities. This could affect various entity names and label...

Exploit for CVE-2022-22972

CVE-2022-22972 POC for CVE-2022-22972 affecting VMware Workspa...

GHSA-MJ5V-GGJC-48P5 XXE vulnerability in Jenkins OWASP Dependency-Check Plugin

Jenkins OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the...