Nord Security: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information

Summary: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information. Description: An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy ...

WordPress GDPR Cookie Consent plugin <= 1.8.2 - Improper Access Controls vulnerability

Improper Access Controls vulnerability found by Jerome Bruandet in WordPress GDPR Cookie Consent plugin versions = 1.8.2. Solution Update the WordPress GDPR Cookie Consent plugin to the latest available version at least 1.8.3...

GDPR Cookie Consent < 1.8.3 - Improper Access Controls

Improper Access Controls issue in the clipolicygenerator AJAX call which could allow an authenticated user with low privileges such as a subscriber to: - Change the status of any post/page from published to draft, removing them from the frontend of the blog. - Put a payload in the content of one...

Database Gateway for ODBC Oracle Database Server Full Control

The vulnerability of the Oracle Database Server ODBC driver’s database server lies in its lack of access control mechanisms. Exploiting this vulnerability allows an attacker to gain full control over the application through the OracleNet network protocol...

Authorization Bypass

node is vulnerable to authorization bypass. Trailing OWS from header values are not stripped, potentially allowing a remote attacker to bypass access controls...

2×4 Security

I had someone at the house recently, talking about physical security. We have all the usual stuff like alarms and CCTV, locks on the windows and doors but the aim of the exercise was to have someone who is familiar with attacks vectors physical security in this case, but the principal applies to...

Security Bulletin: Multiple Information disclosure vulnerabilities affect IBM Sterling B2B Integrator (CVE-2017-1302, CVE-2017-1193)

Summary IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information due to improper access controls Vulnerability Details CVEID: CVE-2017-1302 DESCRIPTION: IBM Sterling B2B Integrator Standard Edition could allow a local user to view sensitive information d...

CVE-2019-4541

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

Input validation

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

CVE-2019-4541

CVE-2019-4541 affects IBM Security Directory Server 6.4.0, where incomplete blocklisting for input validation allows bypassing application controls and impacts system integrity. The issue is tied to 6.4.0 and has remediation in the IBM bulletin: upgrade to 6.4.0.20-ISS-ISDS-IF0020 (or later) to a...

CVE-2019-4541

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

CVE-2019-4541: Undefined Security Weakness

IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814...

DEBIAN-CVE-2020-7955

HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3...

PT-2020-1744 · Cisco · Cisco Small Business Switches

Name of the Vulnerable Software and Affected Versions: Cisco Small Business Switches versions 200, 250, 300, 350, 350X, 500, 550X Description: The issue is related to inadequate data processing in the web interface of the affected devices, which could allow a remote attacker to gain unauthorized...

Linux: Read files in /etc/modprobe.d/ (KB)

Because the modprobe command can add or remove more than one module, due to module dependencies, we need a method of specifying what options are to be used with those modules. All files underneath the /etc/modprobe.d directory which end with the .conf extension specify those options as required...

CVE-2019-4637

IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043...

CVE-2019-4637

IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043...

Input validation

IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043...

CVE-2019-4637

CVE-2019-4637 affects IBM Security Secret Server. The vulnerability stems from incomplete blocklisting used for input validation in Secret Server 10.7, allowing attackers to bypass application controls and potentially impact system integrity and data. IBM’s security bulletin notes this issue has ...

CVE-2019-4637

IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 170043...