23341 matches found
CVE-2026-75792
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a client-side authorization bypass (CWE-285: Improper Authorization) that allows a remote authenticated attacker to view administrative user interface components . The vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM)...
CVE-2026-75792 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...
EUVD-2026-78140
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to view administrative user interface components due to client-side authorization bypass...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
EUVD-2026-78139
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
CVE-2026-78415
IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 are affected by a vulnerability where improper neutralization of user-supplied HTML markup (CWE-79) allows a remote authenticated attacker to perform UI spoofing and phishing attacks . The attack requires low privileges and low complexity...
CVE-2026-78415 IBM Sterling Secure Proxy is vulnerable to multiple issues
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks due to improper neutralization of user-supplied HTML markup...
Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues
Summary Multiple vulnerabilities CVE-2026-78415, CVE-2026-75792 affect IBM Sterling Secure Proxy and are addressed in the latest release and fixpack. Vulnerability Details CVEID:CVE-2026-78415 DESCRIPTION: IBM Sterling Secure Proxy could allow a remote authenticated attacker to perform UI spoofin...
CVE-2026-82433
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-57124 PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
CVE-2026-82433 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI
Description getNimbusConf returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is configured with them, that response includes storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and...
CVE-2026-82433
Apache Storm's Nimbus and UI components are vulnerable to the disclosure of unredacted daemon configurations. The getNimbusConf function failed to redact sensitive information, such as the storm.zookeeper.auth.payload and keystore/truststore passwords for Thrift, Netty, and ZooKeeper TLS configur...
CVE-2026-84179
Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topologyconf field of TopologyPageInfo. The Storm UI copied that value verbatim into the configuration field of GET /api/v1/topology/id and...
Astra Linux – Vulnerability in Firefox
When sharing geolocation during an active WebRTC share, Firefox may reset the WebRTC sharing state in the user interface, resulting in a loss of control over the currently granted permissions. This vulnerability affects Firefox versions earlier than 85...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.216, using free in Google Chrome’s views allowed a remote attacker who convinced a user to perform certain UI gestures to execute arbitrary code through a crafted HTML page. Chromium security severity: High...
Astra Linux – Vulnerability in Chromium
Incorrect security user interfaces in Page Info in Google Chrome on iOS prior to version 88.0.4324.96 allowed a remote attacker to spoof the security user interface through a crafted HTML page...
Astra Linux – Vulnerability in Chromium
The use of “after free” in Aura in Google Chrome before version 139.0.7258.127 allowed a remote attacker who convinced a user to perform certain UI gestures to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in Autofill in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to spoof security UI via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in the toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...