askWAM

askWAM askWAM solicita tokens de acceso de Microsoft Entra de forma silenciosa a través del Administrador de cuentas web de Windows WAM. Se distribuye como un cliente de .NET Framework, un cliente nativo x64 independiente y un Beacon Object File x64 con un adaptador de comandos CNA. Todos los...

CVE-2022-45472

CVE-2022-45472 基于DOM的XSS 软件：CAE Learning Space Enterprise（含Intuity许可证） 镜像版本：267r 补丁级别：639 漏洞：基于DOM的XSS 描述 CAE Learning Space Enterprise 管理软件容易受到基于DOM的XSS攻击。基于DOM的XSS攻击是指用户向主机发送一个可执行的载荷，从而在受害者的浏览器中从原始客户端脚本修改DOM环境。该攻击是通过手动搜索Burp请求，使用名为Dalfox https://github.com/hahwul/dalfox...

EUVD-2022-48338

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2020-7664

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/zip, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...

Linux Distros Unpatched Vulnerability : CVE-2020-7668

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In all versions of the package github.com/unknwon/cae/tz, the ExtractTo function doesn't securely escape file paths in zip archives which include leading or...

MAL-2025-10853 Malicious code in @zalastax/nolb-cae (npm)

The package @zalastax/nolb-cae was found to contain malicious code...

Malicious code in @zalastax/nolb-cae (npm)

The package @zalastax/nolb-cae was found to contain malicious code...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

Input validation

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

Spoofing

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...

CVE-2022-32747

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network. Affected Products: EcoStruxure™ Cybersecurity Admin Expert CAE Versions prior to 2.2...

CVE-2022-32748

CVE-2022-32748 affects EcoStruxure™ Cybersecurity Admin Expert (CAE) versions prior to 2.2. Root cause: CWE-295 Improper Certificate Validation, which can cause CAE to present or process incorrect data to end users and may enable credential leakage, allowing an attacker to log into the configurat...

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise...

CAE LearningSpace Enterprise Cross-Site Scripting Vulnerability

CAE LearningSpace Enterprise is a clinical simulation management platform from CAE Canada, Inc. CAE LearningSpace Enterprise with Intuity License image 267r patch 639 contains a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data b...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

Design/Logic Flaw

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-45472

CAE LearningSpace Enterprise with Intuity License image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup...

CVE-2022-45472

CVE-2022-45472 affects CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639. The vulnerability is DOM-based XSS triggered by ontouchmove and onpointerup, allowing injection of script and potential UI/data impact. Root cause relates to insufficient input filtering/escaping of u...