Citrix Provisioning Security Bulletin CVE-2024-6150

Description of Problem A vulnerability has been discovered that impacts Citrix Provisioning. Refer to below for further details: Affected Versions The vulnerability affects the following supported versions of Citrix Provisioning Current Release CR Citrix Provisioning versions before 2402 Long Ter...

PT-2024-37416 · Citrix · Citrix Provisioning

Name of the Vulnerable Software and Affected Versions: Citrix Provisioning affected versions not specified Description: A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning. Recommendations: At the moment, there is no information about a newer version...

Image preparation step 'FixSCCM' failed. error

When updating a catalog with MCS this error is seen . Image Preparation Finalization Failed Stack Trace: at Citrix.Orchestration.Base.PowerShellSdk.ProvisioningSchemeService.BackgroundTasks.ProvisioningSchemeTask.ThrowOnTerminatingErrorSdkProvisioningSchemeAction sdkProvisioningSchemeAction at...

MESbook 安全漏洞

MESbook is a web-based system from MESbook Inc. connects to factory machines and converts data into information for real-time management. MESbook has a Specified Function Provisioning Error vulnerability that can be exploited by an attacker to register a user account without authentication...

PT-2024-6322 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to an External XML Entity XXE vulnerability in the provisioning web service, allowing a remote unauthenticated...

SUSE CVE-2020-26559

Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device participating in the provisioning protocol to identify the AuthValue used given the Provisioner's public key, and the confirmation number and nonce provided by the provisioning device. This could...

eap-galleon: custom provisioning creates unsecured http-invoker

An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server...

eap-galleon: custom provisioning creates unsecured http-invoker

An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server...

eap-galleon: custom provisioning creates unsecured http-invoker

An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server...

PT-2024-6692 · Mitel · Mitel Mivoice Mx-One

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice MX-ONE versions through 7.6 SP1 Description: The provisioning manager component of Mitel MiVoice MX-ONE could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successfu...

CVE-2024-33002

Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...

CVE-2024-33002

CVE-2024-33002 concerns the SAP Data Provisioning Service, specifically the Document Service handler, where user-supplied inputs are not sufficiently encoded, enabling Cross-Site Scripting (XSS). The vulnerability is described as having low impact on confidentiality and integrity. Several connect...

CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)

Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...

CVE-2024-33002 Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS)

Document Service handler obsolete in Data Provisioning Service does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability with low impact on Confidentiality and Integrity of the application...

PT-2024-25049 · Unknown · Data Provisioning Service

Name of the Vulnerable Software and Affected Versions: Data Provisioning Service affected versions not specified Description: The issue is related to the Document Service handler in the Data Provisioning Service, which does not properly encode user-controlled inputs. This results in a Cross-Site...

RHEL 7 : ovirt-engine (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - ovirt-engine: webadmin log out must logout all sessions CVE-2016-6338 - ovirt-engine: API exposes power...

Citrix Provisioning Server - Console User Domain Authentication Failure

While trying to connect to the server console from outside of the PVS server domain you may see an error: "Unable to connect to the Domain Controller if any or the default rootDSE. Error code: 21071225, message: Access is denied. Exception from HRESULT: 0x80070005 EACCESSDENIED, provider:." The P...

GHSA-5X96-J797-5QQW Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution

To minimize the risk of privilege misuse, a trend in the privileged access management PAM solution market involves implementing just-in-time JIT privileged access. This approach to privileged identity management aims to mitigate the risks associated with prolonged high-level access by granting...

CVE-2024-20348

A vulnerability in the Out-of-Band OOB Plug and Play PnP feature of Cisco Nexus Dashboard Fabric Controller NDFC could allow an unauthenticated, remote attacker to read arbitrary files. This vulnerability is due to an unauthenticated provisioning web server. An attacker could exploit this...