Reflected XSS In User/Roles Function

Description URL: https://demo.pimcore.fun/admin/ In Setting select User/Roles and select User. After created user, move to Workspace tab and inject payload XSS at Documents, Assets and Data Objects. XSS payload will be trigger. Besides, Workspace in Roles Also having the same situation. Can you...

Unable to connect to Storefront using Workspace App

Adding store fails with error 'cannot contact store' We can access store via CWA for web...

VMWare Workspace One Access Remote Code Execution (CVE-2022-31659)

A remote code execution vulnerability exists in VMWare Workspace One Access. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

VMWare Workspace One Access Authentication Bypass (CVE-2022-31656)

An authentication bypass vulnerability exists in VMWare Workspace One Access. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information and gain unauthorized access to the affected system...

Auto Redirection to Desktop/App list via Gateway stucked in "Detect Citrix Workspace app" page

To auto launch desktop, you should ensure Citrix Webhelper work as invoked mode to accessdesktop/app via Citrix Gateway, please refer toCTX221662 for more details. This need user to encounter "Detect Citrix Workspace app" page to check local installed Citrix Workspace app. If you do not see this...

Hotkey "CTRL+Break" does not work on Windows VDA through Citrix Workspace app for Linux Clients

The CTRL+Break hotkey does not work if we launch a Windows VDA session from a Citrix Workspace for Linux client. Steps to reproduce the issue 1. Open the Windows Command Prompt in the Windows VDA session from Citrix Workspace for Linux client. 2. Run the "ping -t google.com" command 3. Press the...

What we know about VMWare CVE-2022–31656 and CVE-2022–31659

Takeaways: VMWare Workspace ONE vulnerabilities CVE-2022-31656 and CVE-2022-31659 work in tandem to allow a remote attacker with network access to conduct remote code execution on the server. Imperva Threat Research has seen a sharp rise in attacks since a POC was published on August 9, mostly...

Workspace error 2306 happen when ICA file located in path which contains Chinese characters

Workspace error 2306 happen when ICA file located in path which contains Chinese character. Error message "Could not find the file named "C:??\.ica. Please check your installation , or contact your administrator."...

VMware Workspace One Access Path Traversal

The vulnerability of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools is related to an incorrect limitation on the path name to the restricted directory...

VMware Workspace One Access Output Injection

The vulnerability of the VMware Workspace One Access application management platform and the VMware Identity Manager vIDM administration console is related to incorrect elimination of special elements in the output data. Exploiting this vulnerability can allow a malicious actor to redirect a user...

VMware Workspace One Access Code Generation Code Execution

The vulnerability of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools is related to improper code generation. Exploiting this vulnerability allows a...

VMware Workspace One Access Privilege Escalation

The vulnerabilities of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools are related to deficiencies in access control. Exploiting these vulnerabilities ca...

VMware Workspace One Access Code Generation Code Execution

The vulnerability of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools is related to improper code generation. Exploiting this vulnerability allows a...

VMware Workspace One Access SQL Injection

The vulnerability of the VMware Workspace One Access application management platform, as well as the VMware Identity Manager administration consoles, is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute...

VMware Workspace One Access Privilege Escalation

The vulnerabilities of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools are related to deficiencies in access control. Exploiting these vulnerabilities ca...

VMware Workspace One Access XSS

The vulnerability of the VMware Workspace One Access application management platform, as well as the VMware Identity Manager administration consoles and VMware vRealize Automation virtual infrastructure management tools, exists due to the lack of security measures taken to protect the website...

VMware Workspace One Access Privilege Escalation

The vulnerabilities of the VMware Workspace One Access application management platform, the VMware Identity Manager administration console, and the VMware vRealize Automation virtual infrastructure management tools are related to deficiencies in access control. Exploiting these vulnerabilities ca...

VMware Workspace One Access / VMware Identity Manager Multiple Vulnerabilities (VMSA-2022-0021)

The VMware Workspace One Access formerly VMware Identity Manager application running on the remote host is affected by the following vulnerabilities: - An authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain...

VMware Workspace ONE Access Installed

Binary data vmwareworkspaceoneaccessinstalled.nbin...

Slack: CSV export/import functionality allows administrators to modify member and message content of a workspace

On August 6th, 2022 @security-warrior submitted a report in HackerOne to Slack regarding the CSV export/import functionality primarily used by administrators to merge workspaces. The report centers on the ability of an administrator to modify an export to change user or message content. Upon...