Code injection

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM Man in the Middle between a zero client and AWS session provisioner in the network. This issue is only...

CVE-2022-1805

CVE-2022-1805 describes a MITM risk in Teradici PCoIP Zero Clients when connecting to Amazon Workspaces: the SHA256 presented by the AWS Connection Configurator is not fully verified by the Zero Client, allowing potential interception between the Zero Client and the AWS session provisioner. The i...

CVE-2022-1805

When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM Man in the Middle between a zero client and AWS session provisioner in the network. This issue is only...

PT-2022-14126 · Teradici · Pcoip Zero Client

Name of the Vulnerable Software and Affected Versions: PCoIP Zero Client affected versions not specified Description: The issue arises when connecting to Amazon Workspaces, as the SHA256 presented by the AWS connection provisioner is not fully verified by Zero Clients. This could be exploited by ...

Teradici PCoIP Zero Clients 信任管理问题漏洞

Teradici PCoIP Zero Clients is an ultra-secure endpoint from Teradici Canada. It uses a highly integrated, specialized processor to transmit pixels, not data, to the user's desktop. A trust management issue vulnerability exists in Teradici PCoIP Zero Clients Firmware version 22.01.5, 22.04.1 and...

Malicious code in workspaces_api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f6a19cbcf5e87f030986907a617618f131ae53ae924cff5278b008371bb49c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arm-workspaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f839c7c5f392665a6fb4514cbac04fe8c2bb1e2d6634d091fc7cccfdae80d498 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1120 Malicious code in arm-workspaces (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f839c7c5f392665a6fb4514cbac04fe8c2bb1e2d6634d091fc7cccfdae80d498 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-arm-workspaces-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 306ff4b6fffa361d81e979b5ef2a337379a04e79ef23b632170418748925c574 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1297 Malicious code in azure-arm-workspaces-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25fdf3e3810b11986993e1ee312d73c2be2e122399ae83f6c577f58853782c50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1296 Malicious code in azure-arm-workspaces-samples-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 306ff4b6fffa361d81e979b5ef2a337379a04e79ef23b632170418748925c574 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-arm-workspaces-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25fdf3e3810b11986993e1ee312d73c2be2e122399ae83f6c577f58853782c50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

CVE-2022-29244 npm packing does not respect root-level ignore files in workspaces

npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish inside a workspace, as of v7.9.0 and v7.13.0 respectively, may be affected and have published...

GHSA-HJ9C-8JMM-8C52 Packing does not respect root-level ignore files in workspaces

Impact npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag ie. --workspaces, --workspace=. Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published...

GHSA-4PW5-R58H-FV24 Path traversal vulnerability on Windows in Jenkins

The file browser for workspaces, archived artifacts, and userContent/ in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows. This results in a path traversal vulnerability allowing attackers with Overall/Read permission Windows controller o...

GHSA-X2Q9-R8GM-F657 Drupal Core Access bypass vulnerability

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see conten...

Drupal Core Access bypass vulnerability

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see conten...

CVE-2020-13667

Access bypass vulnerability in of Drupal Core Workspaces allows an attacker to access data without correct permissions. The Workspaces module doesn't sufficiently check access permissions when switching workspaces, leading to an access bypass vulnerability. An attacker might be able to see conten...

Improper Neutralization of Input During Web Page Generation in Jenkins

Cross-site scripting XSS vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts...