CVE-2023-27132

TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web portal. NOTE: CVE-2023-31069 is only about the TSplus Remote Access product, not the TSplus Remote Work product...

TSplus Security Vulnerabilities

TSplus is a remote access software software from TSplus. A security vulnerability exists in TSplus Remote Work version 16.0.0.0, which originates from a plaintext password placed on the var pass of the HTML source code of the secure single sign-on web portal...

CVE-2023-27133

TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILESX86%\TSplus-RemoteWork\Clients\www folder. This may enable privilege escalation if a different local user modifies a file. NOTE: CVE-2023-31067 and CVE-2023-31068 are only about the TSplus Remot...

CVE-2023-27132

The CVE-2023-27132 entry targets TSplus Remote Work: version 16.0.0.0 stores a cleartext password on the var pass line of the HTML source code for the secure single sign-on web portal. Connected sources corroborate that credentials are stored in plaintext within the HTML of the login page (e.g., ...

CVE-2023-27133

The CVE-2023-27133 entry affects TSplus Remote Work 16.0.0.0, reporting weak permissions for .exe, .js, and .html files under %PROGRAMFILES(X86)%\TSplus-RemoteWork\Clients\www. These permissions could allow privilege escalation if a different local user modifies a file. Red Hat and PTSecurity sou...

SUSE-SU-2023:4069-1 Security update for go1.21

This update for go1.21 fixes the following issues: - Update to go1.21.3 bsc1212475 - CVE-2023-39325: Fixed a flaw that can lead to a DoS due to a rapid stream resets causing excessive work. This is also known as CVE-2023-44487. bsc1216109...

HTTP/2 rapid reset can cause excessive work in net/http

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

GHSA-QPPJ-FM5R-HXR3 HTTP/2 Stream Cancellation Attack

HTTP/2 Rapid reset attack The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RSTSTREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The clie...

PT-2023-9472

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to possible store tearing in the neigh periodic work function. It was found that an annotation was missing when deleting an RCU protected item from a list. To preven...

Linux kernel resource management error vulnerability

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A resource management error vulnerability exists in the Linux kernel that stems from a post-release reuse vulnerability in the function cyttsp4watchdogwork...

PT-2023-9477

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a NULL pointer dereference in the RDMA/siw component of the Linux kernel. When immediate MPA request processing fails, the newly created endpoint unlinks the...

PT-2023-9370

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.5.3 Description The issue is related to a use-after-free bug in the Linux kernel. This bug occurs because the original code puts flush work before timer shutdown sync in switch drv remove, allowing the worker t...

3 Steps to Elevate Your Cybersecurity in a Post-Pandemic World

As cybercrime grows more sophisticated in the remote work era, you can take three essential steps to fortify your organization against evolving threats...

TSPlus 16.0.0.0 Insecure Permissions

Exploit Title: TSplus 16.0.0.0 - Remote Work Insecure Files and Folders Permissions Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31068 With TSPlus Remote Work v...

TSPlus 16.0.0.0 Insecure Credential Storage

Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31069 With TSPlus Remote Work v. 16.0.0.0 you ca...

TSplus 16.0.0.0 - Remote Work Insecure Files and Folders Vulnerability

Exploit Title: TSplus 16.0.0.0 - Remote Work Insecure Files and Folders Permissions Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31068 With TSPlus Remote Work v. 16.0.0.0 you can crea...

TSPlus 16.0.0.0 - Remote Work Insecure Credential storage Vulnerability

Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31069 With TSPlus Remote Work v. 16.0.0.0 you can create a secure...

TSPlus 16.0.0.0 - Remote Work Insecure Credential storage

Exploit Title: TSPlus 16.0.0.0 - Remote Work Insecure Credential storage Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31069 With TSPlus Remote Work v. 16.0.0.0 you ca...

TSplus 16.0.0.0 - Remote Work Insecure Files and Folders

Exploit Title: TSplus 16.0.0.0 - Remote Work Insecure Files and Folders Permissions Date: 2023-08-09 Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia Vendor Homepage: https://tsplus.net/ Version: Up to 16.0.0.0 Tested on: Windows CVE : CVE-2023-31068 With TSPlus Remote Work v...

5 Cloud Security Predictions for 2023

COVID's impact still resonates. Remote work, AI, and a turbulent economy have made the future unpredictable, including the future of cloud security. But we still have best practices for you! Let's examine 5 cloud security predictions to be aware of in 2023...