UBUNTU-CVE-2019-17382

An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. An attacker can bypass the login page and access the dashboard page, and then create a Dashboard, Report, Screen, or Map without any Username/Password i.e., anonymously. All created elements...

PT-2019-5822 · Zabbix +1 · Zabbix +1

Name of the Vulnerable Software and Affected Versions: Zabbix versions prior to 4.4 Description: An issue was discovered in "zabbix.php?action=dashboard.view&dashboardid=1" that allows an attacker to bypass the login page and access the dashboard page anonymously. The attacker can then create a...

CVE-2019-15000

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 the fixed version for 5.16.x , from 6.0.0 before 6.0.10 the fixed version for 6.0.x, from 6.1.0 before 6.1.8 the fixed version for 6.1.x, from 6.2.0 before 6.2.6 the fixed version for 6.2.x, from 6.3.0 before 6.3.5 t...

CVE-2019-14995

The /rest/api/1.0/render resource in Jira before version 8.4.0 allows remote anonymous attackers to determine if an attachment with a specific name exists and if an issue key is valid via a missing permissions check...

Magento API Anonymous Access

Sensitive Magento 2 API can be accessed by anonymous users. Therefore, confidential merchant information can be exposed like offline products, stock information or store configuration for example. No source data...

subversion: NULL pointer dereference in svnserve leading to an unauthenticated remote DoS

A flaw was found in subversion. A remote, unauthenticated user can cause a null-pointer-dereference in svnserve by sending a certain sequences of protocol commands to the server. This results in a denial of service in some server configurations, specifically when anonymous access is enabled. The...

VulnCheck KEV: CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution...

Using SMB to bypass PHP Remote File Inclusion limit-vulnerability warning-the black bar safety net

In this article, I share a little bit of PHP Program in a remote file inclusion vulnerability, it will often be in the file contains is use. Although the PHP environment has been configured to prohibit from the remote HTTP/FTP URL contains the file, but I will share how to bypass Remote File...

DRUPAL-CONTRIB-2019-004

The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...

PT-2019-4310 · Kubernetes +1 · Kubernetes Api Server +1

Name of the Vulnerable Software and Affected Versions: Kubernetes API server versions v1.0 through v1.12 Kubernetes API server versions prior to v1.13.12 Kubernetes API server versions prior to v1.14.8 Kubernetes API server versions prior to v1.15.5 Kubernetes API server versions prior to v1.16.2...

Information Disclosure

atomic-openshift is vulnerable to information disclosure. An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a...

Dropbox: Disclose anonymous accessible link on embedded files in paper dropbox sessions

This report described some of the behavior of the integration between Dropbox and Dropbox Paper. In particular, when embedding a Dropbox file into Dropbox Paper, this implicitly creates a link to that file see https://www.dropbox.com/help/files-folders/view-only-access and embeds it within the...

CVE-2018-16959

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI ...

Uber: [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools

A configuration file on experience.uber.com exposed details for the server configuration as well as information about the content hosted on the site. The site itself did require authentication to log in, but this config file was publicly accessible. Other accessible URLs included slide deck...

Design/Logic Flaw

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

CVE-2017-3209

The CVE-2017-3209 entry concerns the DBPOWER U818A WIFI quadcopter drone, which runs an FTP server on its local AP that by default allows anonymous access with full filesystem permissions. The anonymous user can read arbitrary files (e.g., images/videos) and even replace system files such as /etc...

Microsoft Windows: Network access: Named Pipes that can be accessed anonymously

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnapipesaccessedanonym.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Named Pipes that can be accessed anonymously Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

VPNFilter Malware Impact Larger Than Previously Thought

Researchers say the impact of the VPNFilter malware discovered last month is larger than originally reported. On Wednesday, Cisco Talos researchers said they now believe the malware has infected twice the number of router brands than previously stated. They added that VPNFilter also delivers a mo...

CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment permits an...