All CVEs — page 394 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
AiSOC versions 7.2.0 before 12.0.0 allow authenticated users to inject commands by manipulating unescaped parameters, leading to potential execution of arbitrary commands with SYSTEM or root privileges.
The AiSOC platform has a hard-coded JWT secret that allows unauthenticated attackers to forge subscription tickets and access live alerts, cases, agent events, and graph updates from any tenant. This creates a cross-tenant data exposure vulnerability where attackers can view sensitive real-time information across multiple customer environments.