557 matches found
CVE-2019-8834
The CVE-2019-8834 entry affects Apple’s CFNetwork (and related iCloud/WebKit contexts in Apple OS releases). Description: a configuration issue may allow an attacker in a privileged network position to bypass HSTS for a limited set of top‑level domains not previously in the HSTS preload list. Aff...
CVE-2019-8834
A configuration issue was addressed with additional restrictions. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, iOS 13.3 and iPadOS 13.3, iTunes 12.10.3 for Windows, iClo...
CVE-2018-4433
CVE-2018-4433 describes a configuration issue that could allow a malicious application to modify protected parts of the file system. The entry is fixed by Apple in macOS Mojave 10.14.4 and Security Update 2019-002 for High Sierra and Sierra, as well as in watchOS 5, iOS 12, and tvOS 12. Public re...
CVE-2018-4433: Undefined Security Weakness
A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, watchOS 5, iOS 12, tvOS 12, macOS Mojave 10.14. A malicious application may be able to modify protected parts of th...
CVE-2020-26930
NETGEAR EX7700 devices before 1.0.0.210 are affected by incorrect configuration of security settings...
ident Service Information Disclosure Vulnerability
This remote host is running an ident service. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2020-24612
An issue was discovered in the selinux-policy aka Reference Policy package 3.14 through 2020-08-24 because the .config/Yubico directory is mishandled. Consequently, when SELinux is in enforced mode, pam-u2f is not allowed to read the user's U2F configuration file. If configured with the nouserok...
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Trustpoint Configuration Defaults
Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software can be configured for certificate authentication in remote access VPN deployments. An external researcher has identified several misconfigured Cisco ASA and FTD Software remote access devices where the...
PVS Bootstrap configuration missing after updating to 1912 LTSR or 2203 CUs
Error - There must be at least 1 and at most 4 logon servers in the list Bootstrap configuration missing post update to 1912 .CU X / 2203 .CU x...
Design/Logic Flaw
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices and possibly other products allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly...
CVE-2020-9015: Undefined Security Weakness
Arista DCS-7050QX-32S-R 4.20.9M, DCS-7050CX3-32S-R 4.20.11M, and DCS-7280SRAM-48C6-R 4.22.0.1F devices and possibly other products allow attackers to bypass intended TACACS+ shell restrictions via a | character. NOTE: the vendor reports that this is a configuration issue relating to an overly...
XenMobile LDAP Settings: Bad Request
When attempting to configure an LDAP server in XenMobile, "Bad Request" is shown in the web console. LDAP connection is attempted on port 389 plain text. Ping to the LDAP server is successful. Connection is successful. XenMobile Debug Logs show the following: 2018-05-18T13:09:08.526+0000 | | INFO...
Razer: Expired reCAPTCHA site key leads to Rate Limit Bypass and Email Enumeration
The tester discovered a configuration issue involving Google reCAPTCHA that would allow adversaries to enumerate valid email addresses for users. While minor, Razer appreciates the report and clear PoC...
PT-2019-9041 · Yandex · Clickhouse
Name of the Vulnerable Software and Affected Versions: ClickHouse versions prior to 1.1.54131 Description: The issue is related to an incorrect configuration in the deb package, which could allow unauthorized use of the database. Recommendations: For versions prior to 1.1.54131, update to version...
The vulnerability of HP Deskjet printer’s microprogramming software, related to the falsification of inter-site requests, allows a perpetrator to cause malfunctions in service or configuration of the device.
The vulnerability of HP Deskjet printer’s microprogramming software is related to the manipulation of inter-site requests. Exploiting this vulnerability can allow an attacker to cause service failures or configuration violations of the device remotely...
Command injection
DISPUTED The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed...
CVE-2019-12928
The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a...
OPENSUSE-SU-2019:1246-1 Security update for blueman
This update for blueman fixes the following issues: The following security issue was addressed: - Fixed the polkit authorization checks in blueman, which previously allowed any user with access to the D-Bus system bus to trigger certain network configuration logic in blueman without authenticatio...
CVE-2019-6140
A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed...
Design/Logic Flaw
A configuration issue has been discovered in Forcepoint Email Security 8.4.x and 8.5.x: the product is left in a vulnerable state if the hybrid registration process is not completed...