569 matches found
SSL Scan from https://myssl.com/ Reports ADC SSL vServer TLS 1.3 is Disabled
If you perform an SSL scan fromhttps://myssl.com/, sometimes it reports TLS1.3 is disabled even if ADC vServer is correctly configured...
PUB-A-211647233
In onCreate of VzwSetupActivity.java, there is a possible bypass of carrier network restrictions through ESIM due to a missing configuration check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
GHSA-MRFM-JXGF-2H6V Elasticsearch Improper Access Control vulnerability
The default configuration in Elasticsearch before 1.4.0.Beta1 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. NOTE: this only violates the vendor's intended security policy if the user does not run...
Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members
Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...
PT-2022-9992 · Qualcomm · Snapdragon Connectivity +4
Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon affected versions not specified Description: The issue is related to a possible assertion due to improper validation of TCI configuration in various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon...
Apple iOS和Apple iPadOS 输入验证错误漏洞
Apple iOS and Apple iPadOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices and Apple iPadOS is an operating system for iPad tablets. Apple iOS and Apple iPadOS are vulnerable to an input validation error, which stems from The vulnerability is caused b...
CVE-2022-21654 Incorrect configuration handling allows TLS session re-use without re-validation in Envoy
Envoy is an open source edge and service proxy, designed for cloud-native applications. Envoy's tls allows re-use when some cert validation settings have changed from their default configuration. The only workaround for this issue is to ensure that default tls settings are used. Users are advised...
CVE-2022-23630
Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This occurs when dependency verification is disabled ...
Design/Logic Flaw
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...
JMSAppender - Log4j 1.2 Vulnerability CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in...
CVE-2020-35209
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information...
Inability to de-op players if listed in ops.txt with non-lowercase letters
Impact Originally reported in iTXTech/Genisys1188 txt PotterHarry98 potterharry98 deop PotterHarry98 will remove potterharry98 from the ops.txt but not PotterHarry98. Operator permissions are checked using Config-exists with lowercase=true, which will result in a match:...
Huawei Smartphone资源管理错误漏洞
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. Huawei HarmonyOS is vulnerable to a resource management error that results from a problem with the configuration of certain system resources and can be exploited by attackers to cause a denial of service attack...
CVE-2020-18121
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell...
CVE-2020-18121
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell...
CVE-2020-18121
The CVE-2020-18121 issue affects Indexhibit CMS, version 2.1.5, due to a misconfiguration that lets authenticated attackers modify .php files and obtain shell access. Root cause: misconfiguration in indexhibit 2.1.5; Impact: potential full shell on the server via modified PHP files. Exploitation ...
CVE-2020-18121
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell...
CVE-2020-18121: Incorrect Permission Assignment for Critical Resource
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell...
Default configuration
Cachet is an open source status page system. Prior to version 2.5.1, authenticated users, regardless of their privileges User or Admin, can leak the value of any configuration entry of the dotenv file, e.g. the application secret APPKEY and various passwords email, database, etc. This issue was...