GHSA-3VX3-XF6Q-R5XP Exposure of Resource to Wrong Sphere in Apache Tomcat

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was...

Fortinet FortiSOAR Access Control Error Vulnerability

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet U.S.A. An access control error vulnerability exists in Fortinet FortiSOAR, which stems from an application access restriction error that could be exploited by a remote, unauthenticated attacker to...

GHSA-77M7-9WVW-87FX Privilege Issues in jailed

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert method which can access the main application. Exported methods are stored in the application.remote object...

CVE-2022-25590

SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application...

Design/Logic Flaw

A permissions issue was addressed with improved validation. This issue is fixed in Security Update 2022-001 Catalina, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be able to access restricted files...

Samsung Wear Os Access Control Error Vulnerability

Samsung Wear Os is a version of the Android operating system from Samsung South Korea, designed for wearable computer devices such as smartwatches. Designed for wearable computer devices such as smartwatches, an access control error vulnerability exists in StRetailModeReceiver in Samsung Wear Os ...

Deploying Zero Trust Network Access for Secure Application Access? Don’t Forget to Secure Your Employees

Secure your workforce with the help of multi-factor authentication and Akamai's Zero Trust Network Access application in place of a virtual private network VPN...

Hospitals Patient Records Management System 1.0 - Account TakeOver Vulnerability

Exploit Title: Hospitals Patient Records Management System 1.0 - Account TakeOver Exploit Author: twseptian Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html Software Link:...

Akamai Enterprise Application Access Client 代码问题漏洞

Akamai Enterprise Application Access Client Akamai Eaa Client is an enterprise application access program from Akamai, Inc. It is used to provide fast, secure access. A security vulnerability exists in Akamai EAA, which stems from an unquoted path that could allow an attacker to hijack the...

in getgrav/grav

✍️ Description Developers often set cookies to be accessible from the root context path "/". Doing so exposes the cookie to all web applications on the domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability...

Zero Trust Network Access Is an Oxymoron

Though Zero Trust is really quite simple and should be viewed as a very strong form of the age-old principle of least privilege, that does not mean that it is the same thing. In fact, one of the most significant differences from what came before is that when it comes to access, Zero Trust is base...

Zero Trust Network Access Is an Oxymoron

Though Zero Trust is really quite simple and should be viewed as a very strong form of the age-old principle of least privilege, that does not mean that it is the same thing. In fact, one of the most significant differences from what came before is that when it comes to access, Zero Trust is base...

Google Android Media Framework Information Disclosure Vulnerability (CNVD-2021-52345)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. An information disclosure vulnerability exists in the Media Framework component of Google Android versions 8.1, 9, 10, and 11, which can be exploited by an attacker...

New Admin Portal for Akamai Enterprise Application Access

The definition of a user has evolved to comprise much more than an employee, making secure access to the right application, for the right user, at the right time difficult and complex...

Akamai EAA Impersonation Vulnerability - A Deep Dive

In this post, we cover the technical details of CVE-2021-28091, the vulnerability impacting Akamai's Enterprise Application Access EAA platform...

Authentication Bypass

pulsar-broker-common is vulnerable to authentication bypass. The JSON Web Token JWT is not validated when authenticating clients using JWT and allows an attacker to authenticate and access the application as any user...

CVE-2021-23008

On version 15.1.x before 15.1.3, 14.1.x before 14.1.4, 13.1.x before 13.1.4, 12.1.x before 12.1.6, and all versions of 16.0.x and 11.6.x., BIG-IP APM AD Active Directory authentication can be bypassed via a spoofed AS-REP Kerberos Authentication Service Response response sent over a hijacked KDC...

Amazon Cosori Smart Code Execution Vulnerability

amazon COSORI Smart is a hardware device from amazon. Smart WiFi Air Fryer. A security vulnerability exists in Cosori Smart 5.8-Quart, which can be exploited by an attacker to gain full access to an application and compromise an affected system...

Phish-Proof Multi-Factor Authentication with Akamai MFA

Today, Akamai announced Akamai MFA, a phish-proof multi-factor authentication MFA service for the workforce that delivers all of the security benefits of FIDO2 with the frictionless end-user experience of a mobile push on a smartphone. Why has Akamai introduced this new service? When an employee...

Sql injection

FUEL CMS 1.4.8 allows SQL injection via the 'fuelreplaceid' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database...