1697 matches found
Default configuration
Incorrect default permissions in some IntelR VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access...
Default configuration
A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verifyemailenabled" will only validate email only on sign up...
Insecure SSH Configuration
vantage6 is vulnerable to Insecure SSH Configuration. The vulnerability is due to the default configuration on nodes and servers, allowing root login with password authentication. This configuration is overly permissive...
Default configuration
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...
CVE-2024-22207 Default swagger-ui configuration exposes all files in the module
fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of @fastify/swagger-ui without baseDir set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting th...
VulnCheck KEV: CVE-2023-27524
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRETKEY according to installation instructions...
PT-2024-15001 · Unknown · Class.Upload.Php
Name of the Vulnerable Software and Affected Versions: class.upload.php affected versions not specified Description: The issue is related to a stored XSS vulnerability in the default configuration of class.upload.php, a PHP library for managing image uploads. This vulnerability occurs because the...
CVE-2023-5536
A feature in LXD LP1829071, affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate their privilege to root without requiring a sudo password...
Nautobot Security Vulnerability
Nautobot is a web automation platform by the individual developers of Nautobot. A security vulnerability exists in Nautobot versions 1.1.0 through 1.6.7, prior to 2.0.6, which stems from the fact that in the default configuration used by Nautobot, URLs are accessible by default without any user...
Default configuration
When using the default implementation of Verify to check a Captcha, verification can be bypassed. For example, if the first parameter is a non-existent id, the second parameter is an empty string, and the third parameter is true, the function will always consider the Captcha to be correct...
Default configuration
Traefik is an open source HTTP reverse proxy and load balancer. The traefik docker container uses 100% CPU when it serves as its own backend, which is an automatically generated route resulting from the Docker integration in the default configuration. This issue has been addressed in versions...
CVE-2023-6352
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...
CVE-2023-6352 Aquaforest TIFF Server default configuration allows access to arbitrary files
The default configuration of Aquaforest TIFF Server allows access to arbitrary file paths, subject to any restrictions imposed by Internet Information Services IIS or Microsoft Windows. Depending on how a web application uses and configures TIFF Server, a remote attacker may be able to enumerate...
Aquaforest TIFF Server Path Traversal Vulnerability
Aquaforest TIFF Server is a TIFF Tagged Image File Format server from Aquaforest, UK. A security vulnerability exists in Aquaforest TIFF Server that stems from a default configuration that allows access to arbitrary file paths...
Nokia G-040W-Q Security Vulnerability
The Nokia G-040W-Q is a modem from Nokia of Finland. A security vulnerability exists in Nokia G-040W-Q, which originates from the firewall not blocking ICMP TIMESTAMP requests by default. An unauthenticated, remote attacker can exploit the vulnerability by sending a crafted packet, which could...
Default configuration
The 'checkuniventionjoinstatus' prometheus monitoring script and other scripts in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in the process list allowing attackers with local ssh access to gain higher privileges and perform followup attacks. By default, the configuratio...
SUSE CVE-2018-10896
The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "sshdeletekeys: 0", disabling cloud-init's deletion of ssh host keys. In some environments, this could lead to instances created by cloning a golden master or template system, sharing ssh host keys, and being able to...
Denial Of Service (DoS)
cometbft is vulnerable to Denial of service attack. The vulnerability is due to a default configuration in cometbft which may affect block times and consensus participation when fully utilized by chain participants. It is advised that chains consider their specific needs for their use case when...
