Search criteria
21 vulnerabilities by Absolute Software
CVE-2026-40951 (GCVE-0-2026-40951)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:22 – Updated: 2026-05-01 14:29
VLAI
Title
Memory corruption in Secure Access Windows clients prior to 14.50
Summary
CVE-2026-40951 is a memory corruption vulnerability on Secure Access
Windows clients prior to 14.50. Attackers with local control of the
Windows client can send malformed data to an API and trigger a denial of
service.
Severity
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40951",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:29:02.301464Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:29:48.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Windows client"
],
"platforms": [
"Windows"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-40951 is a memory corruption vulnerability on Secure Access \nWindows clients prior to 14.50. Attackers with local control of the \nWindows client can send malformed data to an API and trigger a denial of\n service."
}
],
"value": "CVE-2026-40951 is a memory corruption vulnerability on Secure Access \nWindows clients prior to 14.50. Attackers with local control of the \nWindows client can send malformed data to an API and trigger a denial of\n service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:22:16.201Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40951"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Memory corruption in Secure Access Windows clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-40951",
"datePublished": "2026-04-30T20:22:16.201Z",
"dateReserved": "2026-04-16T00:19:03.573Z",
"dateUpdated": "2026-05-01T14:29:48.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40950 (GCVE-0-2026-40950)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:19 – Updated: 2026-05-01 14:31
VLAI
Title
Buffer overflow in the Secure Access server prior to 14.50
Summary
CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access
server prior to 14.50. Attackers with control of a modified client can
send a specially crafted message to the server and cause a denial of
service
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40950",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:30:52.080810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:31:19.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Server"
],
"platforms": [
"Windows"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access \nserver prior to 14.50. Attackers with control of a modified client can \nsend a specially crafted message to the server and cause a denial of \nservice"
}
],
"value": "CVE-2026-40950 is a buffer overflow vulnerability in the Secure Access \nserver prior to 14.50. Attackers with control of a modified client can \nsend a specially crafted message to the server and cause a denial of \nservice"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:19:11.609Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40950"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in the Secure Access server prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-40950",
"datePublished": "2026-04-30T20:19:11.609Z",
"dateReserved": "2026-04-16T00:19:03.573Z",
"dateUpdated": "2026-05-01T14:31:19.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-40949 (GCVE-0-2026-40949)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:16 – Updated: 2026-05-01 14:32
VLAI
Title
Buffer overflow in Windows clients prior to 14.50
Summary
CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access
Windows client prior to 14.50. Attackers with local control of the
Windows client can use it to trigger a denial of service.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-40949",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:31:44.551419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:32:04.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Windows client"
],
"platforms": [
"Windows"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access \nWindows client prior to 14.50. Attackers with local control of the \nWindows client can use it to trigger a denial of service."
}
],
"value": "CVE-2026-40949 is a buffer overflow vulnerability in the Secure Access \nWindows client prior to 14.50. Attackers with local control of the \nWindows client can use it to trigger a denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:16:19.912Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-40949"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in Windows clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-40949",
"datePublished": "2026-04-30T20:16:19.912Z",
"dateReserved": "2026-04-16T00:19:03.573Z",
"dateUpdated": "2026-05-01T14:32:04.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33452 (GCVE-0-2026-33452)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:12 – Updated: 2026-05-01 14:30
VLAI
Title
Buffer overflow in Windows clients prior to 14.50
Summary
CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access
Windows client prior to 14.50. Attackers with local control of the
Windows client can use it to ‘blue screen’ the system.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:30:08.157097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:30:27.273Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Windows client"
],
"platforms": [
"Windows"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access \nWindows client prior to 14.50. Attackers with local control of the \nWindows client can use it to \u2018blue screen\u2019 the system."
}
],
"value": "CVE-2026-33452 is a buffer overflow vulnerability in the Secure Access \nWindows client prior to 14.50. Attackers with local control of the \nWindows client can use it to \u2018blue screen\u2019 the system."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:12:16.166Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33452"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in Windows clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33452",
"datePublished": "2026-04-30T20:12:16.166Z",
"dateReserved": "2026-03-19T23:04:05.696Z",
"dateUpdated": "2026-05-01T14:30:27.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33451 (GCVE-0-2026-33451)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:08 – Updated: 2026-05-01 14:36
VLAI
Title
Arbitrary read/write vulnerability in Windows clients prior to 14.50
Summary
CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure
Access Windows client prior to 14.50. Attackers with local control of
the Windows client can send malformed data to an API and elevate their
level of privilege to system.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:36:03.654479Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:36:19.832Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Windows client"
],
"platforms": [
"Windows"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system."
}
],
"value": "CVE-2026-33451 is an arbitrary read/write vulnerability in the Secure \nAccess Windows client prior to 14.50. Attackers with local control of \nthe Windows client can send malformed data to an API and elevate their \nlevel of privilege to system."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:08:03.213Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33451"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary read/write vulnerability in Windows clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33451",
"datePublished": "2026-04-30T20:08:03.213Z",
"dateReserved": "2026-03-19T23:04:05.696Z",
"dateUpdated": "2026-05-01T14:36:19.832Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33450 (GCVE-0-2026-33450)
Vulnerability from cvelistv5 – Published: 2026-04-30 20:04 – Updated: 2026-05-01 14:35
VLAI
Title
Out of bounds read in Secure Access MacOS clients prior to 14.50
Summary
CVE-2026-33450 is an out of bounds read vulnerability in the Secure
Access MacOS client prior to 14.50. Attackers with control of a modified
server can send a malformed packet to the client causing a denial of
service.
Severity
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:35:24.810504Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:35:43.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Client"
],
"platforms": [
"MacOS"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33450 is an out of bounds read vulnerability in the Secure \nAccess MacOS client prior to 14.50. Attackers with control of a modified\n server can send a malformed packet to the client causing a denial of \nservice. \u0026nbsp;"
}
],
"value": "CVE-2026-33450 is an out of bounds read vulnerability in the Secure \nAccess MacOS client prior to 14.50. Attackers with control of a modified\n server can send a malformed packet to the client causing a denial of \nservice."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:04:14.383Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33450"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Out of bounds read in Secure Access MacOS clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33450",
"datePublished": "2026-04-30T20:04:14.383Z",
"dateReserved": "2026-03-19T23:04:05.696Z",
"dateUpdated": "2026-05-01T14:35:43.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33449 (GCVE-0-2026-33449)
Vulnerability from cvelistv5 – Published: 2026-04-30 19:52 – Updated: 2026-05-01 14:33
VLAI
Title
Message handler buffer overflow in clients prior to 14.50
Summary
CVE-2026-33449 is a buffer overflow in a message handling function of
the Secure Access client prior to 14.50. Attackers with control of
a modified server can send a cryptographically valid message to the
client, overwriting a small portion of memory conceivably leading to a
denial of service.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:32:57.858228Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:33:13.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Client"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33449 is a buffer overflow in a message handling function of \nthe Secure Access client prior to 14.50. Attackers with control of \na modified server can send a cryptographically valid message to the \nclient, overwriting a small portion of memory conceivably leading to a \ndenial of service."
}
],
"value": "CVE-2026-33449 is a buffer overflow in a message handling function of \nthe Secure Access client prior to 14.50. Attackers with control of \na modified server can send a cryptographically valid message to the \nclient, overwriting a small portion of memory conceivably leading to a \ndenial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T19:52:01.980Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33449"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Message handler buffer overflow in clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33449",
"datePublished": "2026-04-30T19:52:01.980Z",
"dateReserved": "2026-03-19T23:04:05.696Z",
"dateUpdated": "2026-05-01T14:33:13.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33448 (GCVE-0-2026-33448)
Vulnerability from cvelistv5 – Published: 2026-04-30 19:47 – Updated: 2026-05-01 14:35
VLAI
Title
Format string vulnerability in MacOS clients prior to 14.50
Summary
CVE-2026-33448 is a format string vulnerability in the logging subsystem
of Secure Access client for MacOS prior to 14.50. Attackers with
control of a modified server can force the client to dump the contents
of a small portion of memory to the log files potentially revealing
secrets.
Severity
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:34:04.320380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:35:03.996Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Client"
],
"platforms": [
"MacOS"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33448 is a format string vulnerability in the logging subsystem\n of Secure Access client for MacOS prior to 14.50. Attackers with \ncontrol of a modified server can force the client to dump the contents \nof a small portion of memory to the log files potentially revealing \nsecrets."
}
],
"value": "CVE-2026-33448 is a format string vulnerability in the logging subsystem\n of Secure Access client for MacOS prior to 14.50. Attackers with \ncontrol of a modified server can force the client to dump the contents \nof a small portion of memory to the log files potentially revealing \nsecrets."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T19:47:50.031Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33448"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Format string vulnerability in MacOS clients prior to 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33448",
"datePublished": "2026-04-30T19:47:50.031Z",
"dateReserved": "2026-03-19T23:04:05.695Z",
"dateUpdated": "2026-05-01T14:35:03.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33447 (GCVE-0-2026-33447)
Vulnerability from cvelistv5 – Published: 2026-04-30 19:43 – Updated: 2026-05-01 14:32
VLAI
Summary
CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or denial of
service.
Severity
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-01T14:32:25.804347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-01T14:32:40.680Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Client"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33447 is a buffer overflow in a message parsing function of the\n Secure Access client prior to 14.50. Attackers with control of a \nmodified server can send a special packet that can overwrite a small \nportion of memory conceivably leading to memory corruption or denial of \nservice."
}
],
"value": "CVE-2026-33447 is a buffer overflow in a message parsing function of the\n Secure Access client prior to 14.50. Attackers with control of a \nmodified server can send a special packet that can overwrite a small \nportion of memory conceivably leading to memory corruption or denial of \nservice."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T19:43:27.437Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33447"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33447",
"datePublished": "2026-04-30T19:43:27.437Z",
"dateReserved": "2026-03-19T23:04:05.695Z",
"dateUpdated": "2026-05-01T14:32:40.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-33446 (GCVE-0-2026-33446)
Vulnerability from cvelistv5 – Published: 2026-04-30 19:36 – Updated: 2026-04-30 20:11
VLAI
Title
Buffer overflow in client authentication prior to version 14.50
Summary
CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrite a small
portion of memory conceivably leading to memory corruption or a denial
of service.
Severity
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 14.50
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-33446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-30T20:10:07.269398Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T20:11:21.104Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Client"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "14.50",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CVE-2026-33446 is a buffer overflow in the authentication sub-system of \nthe Secure Access client prior to 14.50. Attackers with control of a \nmodified server can send a special packet that can overwrite a small \nportion of memory conceivably leading to memory corruption or a denial \nof service."
}
],
"value": "CVE-2026-33446 is a buffer overflow in the authentication sub-system of \nthe Secure Access client prior to 14.50. Attackers with control of a \nmodified server can send a special packet that can overwrite a small \nportion of memory conceivably leading to memory corruption or a denial \nof service."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T19:39:31.464Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/cve-2026-33446"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Buffer overflow in client authentication prior to version 14.50",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2026-33446",
"datePublished": "2026-04-30T19:36:37.319Z",
"dateReserved": "2026-03-19T23:04:05.695Z",
"dateUpdated": "2026-04-30T20:11:21.104Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-40875 (GCVE-0-2024-40875)
Vulnerability from cvelistv5 – Published: 2024-12-20 20:17 – Updated: 2024-12-24 15:57
VLAI
Title
Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52
Summary
There is a cross-site scripting vulnerability in the
management console of Absolute Secure Access prior to version 13.52. Attackers
with system administrator permissions can interfere with another system
administrator’s use of the management console when the second administrator logs
in. Attack complexity is high, attack requirements are present, privileges
required are high, user interaction required is none. The impact to
confidentiality is none, the impact to availability is low, and the impact to
system integrity is high.
Severity
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.52
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-40875",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-24T15:56:55.279442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-24T15:57:03.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"modules": [
"Management Console"
],
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.52",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the\nmanagement console of Absolute Secure Access prior to version 13.52. Attackers\nwith system administrator permissions can interfere with another system\nadministrator\u2019s use of the management console when the second administrator logs\nin. Attack complexity is high, attack requirements are present, privileges\nrequired are high, user interaction required is none. The impact to\nconfidentiality is none, the impact to availability is low, and the impact to\nsystem integrity is high. \u003c/p\u003e"
}
],
"value": "There is a cross-site scripting vulnerability in the\nmanagement console of Absolute Secure Access prior to version 13.52. Attackers\nwith system administrator permissions can interfere with another system\nadministrator\u2019s use of the management console when the second administrator logs\nin. Attack complexity is high, attack requirements are present, privileges\nrequired are high, user interaction required is none. The impact to\nconfidentiality is none, the impact to availability is low, and the impact to\nsystem integrity is high."
}
],
"impacts": [
{
"capecId": "CAPEC-63",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-63 Cross-Site Scripting (XSS)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-20T20:17:27.132Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1352/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Secure Access administrative console prior to 13.52",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-40875",
"datePublished": "2024-12-20T20:17:27.132Z",
"dateReserved": "2024-07-10T20:40:17.120Z",
"dateUpdated": "2024-12-24T15:57:03.223Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37352 (GCVE-0-2024-37352)
Vulnerability from cvelistv5 – Published: 2024-06-20 17:28 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06 that allows
attackers with system administrator permissions to interfere with other system
administrators’ use of the management UI when the second administrator accesses
the vulnerable page. The scope is unchanged, there is no loss of
confidentiality. Impact to system integrity is high, impact to system
availability is none.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-20T20:38:08.332326Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T20:38:15.755Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.158Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37352/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06 that allows\nattackers with system administrator permissions to interfere with other system\nadministrators\u2019 use of the management UI when the second administrator accesses\nthe vulnerable page. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system integrity is high, impact to system\navailability is none.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06 that allows\nattackers with system administrator permissions to interfere with other system\nadministrators\u2019 use of the management UI when the second administrator accesses\nthe vulnerable page. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system integrity is high, impact to system\navailability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T17:28:47.745Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37352/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37352",
"datePublished": "2024-06-20T17:28:47.745Z",
"dateReserved": "2024-06-05T21:07:26.877Z",
"dateUpdated": "2024-08-02T03:50:56.158Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37351 (GCVE-0-2024-37351)
Vulnerability from cvelistv5 – Published: 2024-06-20 17:25 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the second administrator later
edits the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "secure_access",
"vendor": "absolute",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37351",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-20T19:27:02.413211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T17:36:51.661Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.092Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37351/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with other system\nadministrator\u2019s use of the management UI when the second administrator later\nedits the same management object. This vulnerability is distinct from CVE-2024-37348 and\nCVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact\nto system integrity is high, impact to system availability is none.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with other system\nadministrator\u2019s use of the management UI when the second administrator later\nedits the same management object. This vulnerability is distinct from CVE-2024-37348 and\nCVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact\nto system integrity is high, impact to system availability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T17:25:09.306Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37351/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37351",
"datePublished": "2024-06-20T17:25:09.306Z",
"dateReserved": "2024-06-05T21:07:26.877Z",
"dateUpdated": "2024-08-02T03:50:56.092Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37350 (GCVE-0-2024-37350)
Vulnerability from cvelistv5 – Published: 2024-06-20 17:18 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the policy
management UI of Absolute Secure Access prior to version 13.06. Attackers can
interfere with a system administrator’s use of the policy management UI when
the attacker convinces the victim administrator to follow a crafted link to the
vulnerable component while the attacking administrator is authenticated to the
console. The scope is unchanged, there is no loss of confidentiality. Impact to
system integrity is high, impact to system availability is none.
Severity
6.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37350",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-21T16:14:37.157939Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-21T16:14:44.589Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers can\ninterfere with a system administrator\u2019s use of the policy management UI when\nthe attacker convinces the victim administrator to follow a crafted link to the\nvulnerable component while the attacking administrator is authenticated to the\nconsole. The scope is unchanged, there is no loss of confidentiality. Impact to\nsystem integrity is high, impact to system availability is none.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers can\ninterfere with a system administrator\u2019s use of the policy management UI when\nthe attacker convinces the victim administrator to follow a crafted link to the\nvulnerable component while the attacking administrator is authenticated to the\nconsole. The scope is unchanged, there is no loss of confidentiality. Impact to\nsystem integrity is high, impact to system availability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T17:18:33.952Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37350/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later.\u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37350",
"datePublished": "2024-06-20T17:18:33.952Z",
"dateReserved": "2024-06-05T21:07:26.877Z",
"dateUpdated": "2024-08-02T03:50:56.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37349 (GCVE-0-2024-37349)
Vulnerability from cvelistv5 – Published: 2024-06-20 17:11 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with other system
administrator’s use of the management UI when the victim administrator edits
the same management object. This vulnerability is distinct from CVE-2024-37348 and
CVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact
to system integrity is high, impact to system availability is none.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37349",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T18:19:09.706461Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-01T18:35:21.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.914Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with other system\nadministrator\u2019s use of the management UI when the victim administrator edits\nthe same management object. This vulnerability is distinct from CVE-2024-37348 and\nCVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact\nto system integrity is high, impact to system availability is none.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with other system\nadministrator\u2019s use of the management UI when the victim administrator edits\nthe same management object. This vulnerability is distinct from CVE-2024-37348 and\nCVE-2024-37351. The scope is unchanged, there is no loss of confidentiality. Impact\nto system integrity is high, impact to system availability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T17:11:52.447Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37349/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37349",
"datePublished": "2024-06-20T17:11:52.447Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:55.914Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37348 (GCVE-0-2024-37348)
Vulnerability from cvelistv5 – Published: 2024-06-20 17:05 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site
scripting vulnerability in the management UI of Absolute Secure Access prior to
version 13.06. Attackers with system administrator permissions can interfere
with another system administrator’s use of the management UI when the second
administrator later edits the same management object. This vulnerability is
distinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged,
there is no loss of confidentiality. Impact to system integrity is high, impact
to system availability is none.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37348",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-25T15:07:10.602945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T15:08:45.081Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.211Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\n\n\n\n\n\n\nThere is a cross-site\nscripting vulnerability in the management UI of Absolute Secure Access prior to\nversion 13.06. Attackers with system administrator permissions can interfere\nwith another system administrator\u2019s use of the management UI when the second\nadministrator later edits the same management object. This vulnerability is\ndistinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged,\nthere is no loss of confidentiality. Impact to system integrity is high, impact\nto system availability is none.\n\n\n\n"
}
],
"value": "There is a cross-site\nscripting vulnerability in the management UI of Absolute Secure Access prior to\nversion 13.06. Attackers with system administrator permissions can interfere\nwith another system administrator\u2019s use of the management UI when the second\nadministrator later edits the same management object. This vulnerability is\ndistinct from CVE-2024-37349 and CVE-2024-37351. The scope is unchanged,\nthere is no loss of confidentiality. Impact to system integrity is high, impact\nto system availability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T17:05:04.866Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37348/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37348",
"datePublished": "2024-06-20T17:05:04.866Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:56.211Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37347 (GCVE-0-2024-37347)
Vulnerability from cvelistv5 – Published: 2024-06-20 16:56 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the pool
configuration component of the management UI of Absolute Secure Access prior to
13.06. Attackers with system administrator permissions can pass a limited
length script to be run by another administrator. The scope is unchanged, there
is no loss of confidentiality. Impact to system integrity is high, impact to
system availability is none.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37347",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-27T18:20:53.929647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-01T18:35:38.890Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.946Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the pool\nconfiguration component of the management UI of Absolute Secure Access prior to\n13.06. Attackers with system administrator permissions can pass a limited\nlength script to be run by another administrator. The scope is unchanged, there\nis no loss of confidentiality. Impact to system integrity is high, impact to\nsystem availability is none.\u003c/p\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "There is a cross-site scripting vulnerability in the pool\nconfiguration component of the management UI of Absolute Secure Access prior to\n13.06. Attackers with system administrator permissions can pass a limited\nlength script to be run by another administrator. The scope is unchanged, there\nis no loss of confidentiality. Impact to system integrity is high, impact to\nsystem availability is none."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T16:56:50.468Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37347/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later.\u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37347",
"datePublished": "2024-06-20T16:56:50.468Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:55.946Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37346 (GCVE-0-2024-37346)
Vulnerability from cvelistv5 – Published: 2024-06-20 16:51 – Updated: 2024-08-02 03:50
VLAI
Title
Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06
Summary
There is an insufficient input validation vulnerability in
the Warehouse component of Absolute Secure Access prior to 13.06. Attackers
with system administrator permissions can impair the availability of certain
elements of the Secure Access administrative UI by writing invalid data to the
warehouse over the network. There is no loss of warehouse integrity or
confidentiality, the security scope is unchanged. Loss of availability is high.
Severity
4.9 (Medium)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37346",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-25T15:24:52.742650Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-25T15:24:58.961Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.993Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is an insufficient input validation vulnerability in\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\nwith system administrator permissions can impair the availability of certain\nelements of the Secure Access administrative UI by writing invalid data to the\nwarehouse over the network. There is no loss of warehouse integrity or\nconfidentiality, the security scope is unchanged. Loss of availability is high.\n\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is an insufficient input validation vulnerability in\nthe Warehouse component of Absolute Secure Access prior to 13.06. Attackers\nwith system administrator permissions can impair the availability of certain\nelements of the Secure Access administrative UI by writing invalid data to the\nwarehouse over the network. There is no loss of warehouse integrity or\nconfidentiality, the security scope is unchanged. Loss of availability is high."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T16:51:37.265Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37346/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later. \u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37346",
"datePublished": "2024-06-20T16:51:37.265Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:55.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37345 (GCVE-0-2024-37345)
Vulnerability from cvelistv5 – Published: 2024-06-20 16:45 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the Secure
Access administrative UI of Absolute Secure Access prior to version 13.06.
Attackers can pass a limited-length script to the administrative UI which is
then stored where an administrator can access it. The scope is unchanged, there
is no loss of confidentiality. Impact to system availability is none, impact to
system integrity is high
Severity
5.3 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37345",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-24T15:01:23.955452Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-24T15:04:57.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.264Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the Secure\nAccess administrative UI of Absolute Secure Access prior to version 13.06.\nAttackers can pass a limited-length script to the administrative UI which is\nthen stored where an administrator can access it. The scope is unchanged, there\nis no loss of confidentiality. Impact to system availability is none, impact to\nsystem integrity is high \u003c/p\u003e\n\n\n\n\n\n\u003cbr\u003e"
}
],
"value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative UI of Absolute Secure Access prior to version 13.06.\nAttackers can pass a limited-length script to the administrative UI which is\nthen stored where an administrator can access it. The scope is unchanged, there\nis no loss of confidentiality. Impact to system availability is none, impact to\nsystem integrity is high"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T16:45:51.929Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37345/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or later.\u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or later."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37345",
"datePublished": "2024-06-20T16:45:51.929Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:56.264Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37344 (GCVE-0-2024-37344)
Vulnerability from cvelistv5 – Published: 2024-06-20 16:38 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the Policy
management UI of Absolute Secure Access prior to version 13.06. Attackers with
system administrator permissions can interfere with another system
administrator’s use of the policy management UI when the administrators are
editing the same policy object. The scope is unchanged, there is no loss of
confidentiality. Impact to system availability is none, impact to system
integrity is high.
Severity
4.5 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:absolute:secure_access:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "secure_access",
"vendor": "absolute",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-20T18:09:27.813657Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-30T17:47:34.491Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.114Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the Policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with another system\nadministrator\u2019s use of the policy management UI when the administrators are\nediting the same policy object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high.\u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the Policy\nmanagement UI of Absolute Secure Access prior to version 13.06. Attackers with\nsystem administrator permissions can interfere with another system\nadministrator\u2019s use of the policy management UI when the administrators are\nediting the same policy object. The scope is unchanged, there is no loss of\nconfidentiality. Impact to system availability is none, impact to system\nintegrity is high."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T16:38:26.256Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37344/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access v13.06 or higher.\u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access v13.06 or higher."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37344",
"datePublished": "2024-06-20T16:38:26.256Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:56.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37343 (GCVE-0-2024-37343)
Vulnerability from cvelistv5 – Published: 2024-06-20 16:30 – Updated: 2024-08-02 03:50
VLAI
Title
Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06
Summary
There is a cross-site scripting vulnerability in the Secure
Access administrative console of Absolute Secure Access prior to version 13.06.
Attackers with valid tunnel credentials can pass a limited-length script to the
administrative console which is then temporarily stored where an administrator
using a non-default configuration could click on it while the attacker has a
valid tunnel session with the server. The scope is unchanged, there is no loss
of confidentiality. Impact to system availability is none, impact to system
integrity is high.
Severity
4.8 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Absolute Software | Secure Access |
Affected:
0 , < 13.06
(Server)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37343",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-20T20:46:04.104319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T20:46:12.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:55.892Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37343/"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Secure Access",
"vendor": "Absolute Software",
"versions": [
{
"lessThan": "13.06",
"status": "affected",
"version": "0",
"versionType": "Server"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.06.\nAttackers with valid tunnel credentials can pass a limited-length script to the\nadministrative console which is then temporarily stored where an administrator\nusing a non-default configuration could click on it while the attacker has a\nvalid tunnel session with the server. The scope is unchanged, there is no loss\nof confidentiality. Impact to system availability is none, impact to system\nintegrity is high. \u003c/p\u003e\n\n\n\n\n\n"
}
],
"value": "There is a cross-site scripting vulnerability in the Secure\nAccess administrative console of Absolute Secure Access prior to version 13.06.\nAttackers with valid tunnel credentials can pass a limited-length script to the\nadministrative console which is then temporarily stored where an administrator\nusing a non-default configuration could click on it while the attacker has a\nvalid tunnel session with the server. The scope is unchanged, there is no loss\nof confidentiality. Impact to system availability is none, impact to system\nintegrity is high."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-20T16:30:21.053Z",
"orgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"shortName": "Absolute"
},
"references": [
{
"url": "https://www.absolute.com/platform/security-information/vulnerability-archive/secure-access-1306/cve-2024-37343/"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to Absolute Secure Access 13.06 or higher. \u003cbr\u003e"
}
],
"value": "Upgrade to Absolute Secure Access 13.06 or higher."
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "b6533044-ea05-4482-8458-7bddeca0d079",
"assignerShortName": "Absolute",
"cveId": "CVE-2024-37343",
"datePublished": "2024-06-20T16:30:21.053Z",
"dateReserved": "2024-06-05T21:07:26.876Z",
"dateUpdated": "2024-08-02T03:50:55.892Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}