CVE-2025-54085 Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

CVE-2025-54085 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access to the console and who have been assigned a certain set of permissions can bypass those permissions to improperly read or change other settings. The...

CVE-2025-49084

CVE-2025-49084 affects Absolute Secure Access management console prior to version 13.56. An administrator can overwrite policy rules without permissions due to a privilege-bypass issue (low integrity impact). Initial and connected sources describe high subsequent-system impact on confidentiality ...

CVE-2025-49084 Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements are present, privileges required are...

CVE-2025-49084 Elevation of privilege vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

CVE-2025-49084 is a vulnerability in the management console of Absolute Secure Access prior to version 13.56. Attackers with administrative access can overwrite policy rules without the requisite permissions. The attack complexity is low, attack requirements are present, privileges required are...

CVE-2025-49083 Data deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administrative access to the console can cause unsafe content to be deserialized and executed in the security context of the console. The attack...

CVE-2025-49083 Data deserialization vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.56

CVE-2025-49083 is a vulnerability in the management console of Absolute Secure Access after version 12.00 and prior to version 13.56. Attackers with administrative access to the console can cause unsafe content to be deserialized and executed in the security context of the console. The attack...

CVE-2025-49083

CVE-2025-49083 describes a data deserialization vulnerability in the management console of Absolute Secure Access (versions 12.00 up to 13.55). With high privileges and no user interaction , an attacker with administrative console access can deserialize and execute unsafe content in the console’s...

CVE-2024-25573

CVE-2024-25573 describes a Stored Cross-Site Scripting (XSS) vulnerability in the PingFederate Administrative Console, arising from unsanitized user-supplied data that can trigger JavaScript code execution in subsequent user processing. Affected product: PingFederate Administrative Console (Ping ...

CVE-2024-25573 Stored Cross-Site Scripting in Administrative Console Context

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing...

CVE-2024-25573 Stored Cross-Site Scripting in Administrative Console Context

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing...

PT-2025-25500 · Ping Identity · Pingfederate Administrative Console

Name of the Vulnerable Software and Affected Versions: PingFederate Administrative Console affected versions not specified Description: The issue concerns unsanitized user-supplied data saved in the PingFederate Administrative Console, which could trigger the execution of JavaScript code in...

CVE-2024-25573: Improper Neutralization of Input During Web Page Generation

Unsanitized user-supplied data saved in the PingFederate Administrative Console could trigger the execution of JavaScript code in subsequent user processing...

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack

A critical infrastructure entity within Ukraine was targeted by a previously unseen data wiper malware named PathWiper, according to new findings from Cisco Talos. "The attack was instrumented via a legitimate endpoint administration framework, indicating that the attackers likely had access to t...

CVE-2024-37343

There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.06. Attackers with valid tunnel credentials can pass a limited-length script to the administrative console which is then temporarily stored where an administrato...

CVE-2024-5264

Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis...

CVE-2023-39219

PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumeration requests...

CVE-2023-32315

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

CVE-2021-41554

ARCHIBUS Web Central 21.3.3.815 a version from 2014 does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw,...

CVE-2020-1949

Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks...

CVE-2020-25620

An issue was discovered in SolarWinds N-Central 12.3.0.670. Hard-coded Credentials exist by default for local user accounts named [email protected] and [email protected]. These allow logins to the N-Central Administrative Console NAC and/or the regular web interface...