RHEL 6 : kde-workspace (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched. - kde-workspace: X11 clients can eavesdrop input events while screen is locked CVE-2015-1308 Note that Nessus has not...

CWA 2402 - Microsoft Teams VDI plugin is not shown for Non-Admin user

When installing Citrix Workspace app 2402 LTSR for Windows CWA or later version with Administrator privileges, all the three Add-ons single sign-on, App Protection, Microsoft Teams VDI plugin are shown. But if installing CWA 2402 with non-admin user, all the three Add-ons are not shown...

Trackpad on the latest Magic Keyboards for iPad Pro M4 is not compatible with the CWA for iOS

The trackpad on the latest Magic Keyboards for the new iPad Pro M4 11-inch and 13-inch is currently not compatible with the Citrix Workspace app on iOS...

Fedora 39 : plasma-workspace (2024-d120dc28b8)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d120dc28b8 advisory. CVE-2024-36041 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

Fedora 40 : plasma-workspace (2024-83fc86a0bc)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-83fc86a0bc advisory. CVE-2024-36041 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this iss...

plasma[56]-plasma-workspace -- Unauthorized users can access session manager

David Edmundson reports: KSmserver, KDE's XSMP manager, incorrectly allows connections via ICE based purely on the host, allowing all local connections. This allows another user on the same machine to gain access to the session manager. A well crafted client could use the session restore feature ...

InstallEmbeddedBrowser=N param is not honored by CWA 2403

The installation process for Citrix Workspace App for Windows 2403 is unable to honor command line parameters correctly, causing Citrix Enterprise Browser CEB to be installed even when the switch “InstallEmbeddedBrowser” is set to “N” Example : CitrixWorkspaceApp.exe /silent InstallEmbeddedBrowse...

CVE-2024-36118 Unauthorized viewing of workspace test cases in MeterSphere

MeterSphere is a test management and interface testing tool. In affected versions users without workspace permissions can view functional test cases of other workspaces beyond their authority. This issue has been addressed in version 2.10.15-lts. Users of MeterSphere are advised to upgrade. There...

RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability

The threat actors behind the RedTail cryptocurrency mining malware have added a recently disclosed security flaw impacting Palo Alto Networks firewalls to its exploit arsenal. The addition of the PAN-OS vulnerability to its toolkit has been complemented by updates to the malware, which now...

PT-2024-4752

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207...

PT-2024-26904 · Unknown · Metersphere

Name of the Vulnerable Software and Affected Versions: MeterSphere versions prior to 2.10.15-lts Description: The issue allows users without workspace permissions to view functional test cases of other workspaces beyond their authority. Recommendations: For versions prior to 2.10.15-lts, upgrade ...

MeterSphere security vulnerabilities

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. A security vulnerability exists in versions prior to MeterSphere 2.10.15-lts that stems from allowing users without workspace privileges to view functional test cases in other workspaces that exceed their...

PT-2024-34097 · Citrix · Citrix Workspace App For Mac

Name of the Vulnerable Software and Affected Versions: Citrix Workspace app for Mac affected versions not specified Description: The issue concerns a problem with Citrix Workspace app for Mac. There is no information about the estimated number of potentially affected devices worldwide or details...

Unable to add store to Citrix Workspace App for Windows when Forcepoint agent is installed

When adding a StoreFront store to Citrix Workspace App for Windows, the Google multi-factor authentication page does not load correctly if Forcepoint agent is installed. The authentication form only partially loads. Without Forcepoint agent, the problem disappears...

Citrix Workspace app for Mac Security Bulletin for CVE-2024-5027

A vulnerability has been discovered in Citrix Workspace app for Mac, which, if exploited, may result in elevation of privilege from a local authenticated user to a root user. Affected Versions: The following supported versions of Citrix Workspace app for Mac are affected by the vulnerability:...

PT-2024-40277 · Silverstripe · Silverstripe 4 +4

Name of the Vulnerable Software and Affected Versions: silverstripe/comments module affected versions not specified cwp/starter-theme affected versions not specified cwp/watea-theme affected versions not specified SilverStripe 4 versions prior to 4.2.0 CWP versions prior to 2.0.0 Description: The...

Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

GHSA-CW5R-JX8R-9F7X Jenkins Report Info Plugin Path Traversal vulnerability

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files. Additionally, Report Info Plugin does not support distributed builds. This results in a path traversal vulnerability, allowing attackers with Item/Configure permissio...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...

CVE-2024-5273

Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing attackers with Item/Configure permission to retrieve Surefire failures, PMD violations, Findbugs bugs, and Checkstyle errors on the controller file system by...