Recent Cyberattacks Target Open-source Web Servers

Malicious actors take advantage of people’s reliance on web servers to perform attacks like remote code execution, access control bypass, denial of service, or even cyberjacking the victim servers to mine cryptocurrencies...

The vulnerability in the implementation of Mozilla Firefox browser extensions allows a perpetrator to circumvent established security restrictions.

The vulnerability of Mozilla Firefox browser extensions is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions by bypassing the permission request window during the installation of extensions...

CVE-2021-45106

A vulnerability has been identified in SICAM TOOLBOX II All versions. Affected applications use a circumventable access control within a database service. This could allow an attacker to access the database...

XWiki Platform 安全漏洞

Xwiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company Xwiki. A security vulnerability exists in XWiki Platform that stems from the fact that in the affected version, any user with editing privileges can copy the content of a page to which...

golang: net: incorrect parsing of extraneous zero characters at the beginning of an IP address octet

A flaw was found in golang. Extraneous zero characters at the beginning of an IP address octet are not properly considered which could allow an attacker to bypass IP-based access controls. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

Western Digital My Cloud 代码问题漏洞

Western Digital My Cloud is a personal cloud storage device from Western Digital. A security vulnerability exists in Western Digital My Cloud that could allow an attacker to impersonate the server and access any page on the server by bypassing access control...

haproxy: request smuggling attack or response splitting via duplicate content-length header

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...

IBM WebSphere Application Server Liberty 加密问题漏洞

IBM WebSphere Application Server Liberty is a U.S. IBM company built on the Open Liberty project on top of the Java application server . A security vulnerability exists in IBM WebSphere Application Server Liberty that can be exploited by an attacker to bypass access restrictions to WebSphere AS...

PT-2022-5708 · Symantec · Symantec Endpoint Protection

Name of the Vulnerable Software and Affected Versions: Symantec Endpoint Protection Windows versions prior to 14.3 RU6/14.3 RU5 Patch 1 Description: The issue is related to a Security Control Bypass, which can potentially allow a threat actor to circumvent existing security controls. This...

FastLine Media Beaver Builder 安全漏洞

FastLine Media Beaver Builder is a front-end layout and styling designer from FastLine Media, Inc. It provides a WYSIWYG view when developing content areas. A security vulnerability exists in FastLine Media Beaver Builder, which stems from versions from Beaver Builder to 2.5.0.3, and can be...

haproxy: request smuggling attack or response splitting via duplicate content-length header

Proxy server haproxy has a flaw that can could allow an HTTP request smuggling attack with the goal of bypassing access-control list rules defined by haproxy. The attack was made possible by utilizing an integer overflow vulnerability that allowed reaching an unexpected state in haproxy while...

OESA-2021-1477 keepalived security update

High Availability monitor built upon LVS, VRRP and service pollers. Security Fixes: In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situation...

Netgear NETGEAR R6700v2 授权问题漏洞

NETGEAR R6700v2 is a wireless router from Netgear, Inc. NETGEAR R6700v2 is vulnerable to a permission and access control issue, which stems from the fact that NETGEAR R6700v2 devices prior to version 1.2.0.88 are affected by an authentication bypass. An attacker could exploit this vulnerability t...

Updated keepalived packages fix security vulnerability

In Keepalived through 2.2.4, the D-Bus policy does not sufficiently restrict the message destination, allowing any user to inspect and manipulate any property. This leads to access-control bypass in some situations in which an unrelated D-Bus system service has a settable writable property...

CVE-2021-23803 Access Control Bypass

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters x00-x08 after the function will bypass these restriction...

The vulnerability of the CORS mechanism implementation in Google Chrome browsers allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the CORS mechanism implementation in Google Chrome browser is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to protected information through a specially created we...

Django 2.2 < 2.2.25, 3.1 < 3.1.14, 3.2 < 3.2.10 Access Control Bypass Vulnerability - Windows

Django is prone to an access control bypass vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

USN-5188-1: Keepalived vulnerability

It was discovered that Keepalived incorrectly handled certain messages. An attacker could possibly use this issue to access-control bypass...

USN-5188-1 keepalived vulnerability

It was discovered that Keepalived incorrectly handled certain messages. An attacker could possibly use this issue to access-control bypass...

USN-5178-1 python-django vulnerability

Sjoerd Job Postmus and TengMA discovered that Django incorrectly handled URLs with trailing newlines. A remote attacker could possibly use this issue to bypass certain access controls...