42 matches found
askWAM
askWAM askWAM 通过 Windows Web 账户管理器（WAM）静默请求 Microsoft Entra 访问令牌。它提供三种形式：.NET Framework 客户端、独立的原生 x64 客户端，以及带有 CNA 命令适配器的 x64 Beacon Object File。 所有前端都可以枚举客户端可见的账户，并通过其不透明的 WAM 账户 ID 或精确用户名来定位某个身份。它们绝不会回退到交互式身份验证。 通过此流程请求的令牌将继承以下详细信息： 用户身份验证方法 设备状态，例如合规/混合加入或托管 这种请求令牌的方式在强制执行令牌保护（Token...
CVE-2022-45472
CVE-2022-45472 基于DOM的XSS 软件：CAE Learning Space Enterprise（含Intuity许可证） 镜像版本：267r 补丁级别：639 漏洞：基于DOM的XSS 描述 CAE Learning Space Enterprise 管理软件容易受到基于DOM的XSS攻击。基于DOM的XSS攻击是指用户向主机发送一个可执行的载荷，从而在受害者的浏览器中从原始客户端脚本修改DOM环境。该攻击是通过手动搜索Burp请求，使用名为Dalfox https://github.com/hahwul/dalfox...
EUVD-2022-48338
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2020-7664
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...
Linux Distros Unpatched Vulnerability : CVE-2020-7668
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...
MAL-2025-10853 Malicious code in @zalastax/nolb-cae (npm)
The package @zalastax/nolb-cae was found to contain malicious code...
Malicious code in @zalastax/nolb-cae (npm)
The package @zalastax/nolb-cae was found to contain malicious code...
CVE-2022-45472
CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...
CVE-2022-32748
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
Spoofing
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
Input validation
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
CVE-2022-32747
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
CVE-2022-32748
CVE-2022-32748 affects EcoStruxure™ Cybersecurity Admin Expert (CAE) versions prior to 2.2. Root cause: CWE-295 Improper Certificate Validation, which can cause CAE to present or process incorrect data to end users and may enable credential leakage, allowing an attacker to log into the configurat...
CVE-2022-32748
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
CVE-2022-32748: Improper Certificate Validation
A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...
CVE-2022-32747: Authentication Bypass by Spoofing
A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...
CAE LearningSpace Enterprise Cross-Site Scripting Vulnerability
CAE LearningSpace Enterprise is a clinical simulation management platform from CAE Canada, Inc. CAE LearningSpace Enterprise with Intuity License image 267r patch 639 contains a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data b...
CVE-2022-45472
CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...