Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the push endpoint reflecting the request Origin into the Access-Control-Allow-Origin response header and allowing credentials. An attacker can access sensitive information by...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: SNYK:JAVA-COMVAADIN-21755469...

com.vaadin:mpr-v7 (>=7.0.0, <=8.0.1), com.vaadin:vaadin-cdi (1.9.0) +4 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=7.7.37, <=7.7.54)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =7.7.37, =7.0.0, =1.4.0, =1.4.0, =1.4.0, =1.4.0, =1.5.0 Source cves: CVE-2026-110737 Source advisory: MEND:CVE-2026-110737...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110737 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking due to the improper release of a session lock in the VaadinService.requestEnd process when handling a non-numeric v-uiId request parameter. An attacker can cause the application to become unresponsive by sending request...

CVE-2026-110803 Session Lock Leak on an Invalid UI Id Allows Denial of Service in Vaadin Framework 8

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

com.vaadin:mpr-core (>=7.0.0, <=8.0.1), com.vaadin:mpr-v8 (>=7.0.0, <=8.0.1) +13 more potentially affected by CVE-2026-110803 via com.vaadin:vaadin-server-mpr-jakarta (>=8.19.0, <=8.32.1)

com.vaadin:vaadin-server-mpr-jakarta MAVEN version =8.19.0, =7.0.0, =7.0.0, =4.0.0-beta0, =8.19.0, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.0.0-beta.1, =4.5.1-alpha1 Source cves:...

CVE-2024-14012

Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can result in a privilege escalation. The issue has been fixed i...

EUVD-2024-55044

Potential privilege escalation issue in Revenera InstallShield version 2023 R1 running a renamed Setup.exe on Windows. When a local administrator executes a renamed Setup.exe, the MPR.dll may get loaded from an insecure location and can result in a privilege escalation. The issue has been fixed i...

CVE-2024-14012

CVE-2024-14012 describes a privilege elevation in Revenera InstallShield 2023 R1 on Windows when a local administrator runs a renamed Setup.exe, causing MPR.dll to be loaded from an insecure location. The vulnerability is caused by the loader path for MPR.dll and can lead to elevated privileges. ...

EUVD-2007-4124

Malware in sbrugna...

Enhanced SSO Feature does not work. Applications fail to launch on Windows 11 devices.

After setting up Enhanced SSO according to https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/domain-passthrough-for-single-sign-on , it doesn't work. When trying to launch an application, nothing happens. When using traditional SSO using the old SSONVR.exe mechanism, there is no issu...

CVE-2022-23086

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2022-23086

The FreeBSD Kernel is affected by a heap-based buffer overflow (out-of-bounds write) in the mpr , mps , and mpt drivers. The vulnerability exists because handlers for *_CFG_PAGE read/write ioctls allocate a buffer based on a caller-specified size but copy a fixed-size header into it. If the speci...

CVE-2022-23086

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2022-23086 mpr/mps/mpt driver ioctl heap out-of-bounds write

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

CVE-2022-23086: Out-of-bounds Write

Handlers for CFGPAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small. Users with access to the mpr, mps or mpt device node may...

FreeBSD mpr mps mpt Driver Code Execution

The vulnerability of the mpr, mps, and mpt drivers in the FreeBSD operating system is caused by a buffer overflow in the dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code on the system with elevated privileges, by running a specially created program...