PT-2023-18356 · Jenkins · Jenkins Code Dx Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Code Dx Plugin versions 3.1.0 and earlier Description: A missing permission check in the plugin allows attackers with Item/Read permission to check for the existence of an attacker-specified file path on an agent file system. This iss...

Design/Logic Flaw

In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file pagefile.sys, hibernation file hiberfil.sys, or RAM dump of the entire system. The...

IDOR 漏洞使得攻击者可以在一个组织内任意添加、删除、修改工作空间

Proof of Concept 1 系统中存在两个组织，team1和team2 2 用户user1是 team1 的管理员， 不是team2的管理员 3 用户1在team1中创建工作空间，名为workspace1. 4 用户1使用burpsuit拦截请求，在请求中将team1的ID换成team2的ID 5 查看请求，结果显示成功，用户1可以在team2中任意创建工作空间。 复现视频：https://1drv.ms/v/s!Avwg5C1eKVA4gispbgvOYQkvQ9KP?e=4yimBo...

How to Batch Upgrade Citrix Receiver to Citrix Workspace App with Single Sign-on and Desktop Lock

This article is designed todescribe how to batch upgrade Citrix Receiver to Citrix Workspace App with Single Sign-on and Desktop Lock...

How to set taskbar as auto-hide for all users in HTML5 Workspace App

HTML5 Workspace App taskbar configuration...

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway (SDG) allows a intruder to execute arbitrary code.

The vulnerability of the Restore Workspace function in SCADA systems’ SCADA Data Gateway SDG is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Workspace app timeout when launching desktop VDI which is in powered off state

VDA is in powered Off state on the hypervisor. User clicks on the desktop icon and machine starts on hypervisor due to powerOnlaunch request and registers but the launch fails with the below error : Citrix Workspace : Could not start appThere was a problem contacting "XXX"...

Workspace App Installation Slowness due to Download of Prerequisite Packages

It will take more than 10 mins to install the Workspace app for Windows. And finally, it can install successfully but the overall time is just too long...

Visual Studio Code Server Files Detected

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality including remote workspace access via ssh. Use of this remote workflow creates a hidden directory named .vscode-server on the remote server which may be exposed with...

Design/Logic Flaw

MeterSphere is an open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing, and performance testing. This IDOR vulnerability allows the administrator of a project to modify other projects under the workspace. An attacker can obtain some...

MeterSphere 安全漏洞

MeterSphere is MeterSphere's open source one-stop open source continuous testing platform. MeterSphere version 2.9.0 before the security vulnerability , the vulnerability stems from allowing the administrator of a project to modify other projects under the workspace...

Databricks Platform Cluster Isolation Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Bypassing cluster isolation through insecure defaults and shared storage product: Databricks Platform vulnerable version: PaaS version as of 2023-01-26 fixed version:...

Office application installation when using a Citrix Workspace App version higher than 2107

When launching the first MS Office Pro Plus 2016 application in a session, a partial installation is ran...

Cannot add ADC URL to workspace with cannot connect to Server Error

Cannot add ADC URL to workspace with cannot connect to Server Error ADC use as gateway, with external environment Can access via Web browser and launch resource...

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...

Authentication flaw

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...

CVE-2023-2257

Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attacker with access to the user interface to unlock a Hub Business space without being prompted to enter the password via an unimplemented "Force Login" securi...

CVE-2023-2257

CVE-2023-2257 affects Devolutions Workspace Desktop (Hub Business integration) up to version 2023.1.1.3 on Windows/macOS. The issue is an authentication bypass: when the Force Login feature is enabled and a user has access to a locked Workspace desktop with a Hub Business space, an attacker can u...