| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Tanium addressed a denial of service vulnerability in Enforce. |
| Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server. |
| Tanium addressed an improper output sanitization vulnerability in Enforce. |
| Tanium addressed an improper output sanitization vulnerability in Comply. |
| Tanium addressed an improper access controls vulnerability in Enforce. |
| Tanium addressed an improper certificate validation vulnerability in Stream Client Extension. |
| Tanium addressed an information disclosure vulnerability in Threat Response Client Extension. |
| Tanium addressed a denial of service vulnerability in Enforce. |
| Tanium addressed a use-after-free vulnerability in Threat Response Client Extension. |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. |
| Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5. |
| Tanium addressed a denial of service vulnerability in Tanium Server. |
| Tanium addressed a compression bomb vulnerability in Enforce. |
| Tanium addressed a local privilege escalation vulnerability in End-User Notifications. |
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. |
| Tanium addressed a SQL injection vulnerability in Provision. |
| Tanium addressed a SQL injection vulnerability in Patch. |
| A weakness has been identified in oretnom23 php-travel-agency-system. The affected element is an unknown function of the file contact_insert.php of the component Contact Form Handler. This manipulation of the argument name/company/email/topic/phone/comments causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. |
| PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service. |
