3256 matches found
Cisco Identity Services Engine Authentication Bypass (cisco-sa-ISE-SAML-nuukMPf9)
A vulnerability in the login page of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to log in without credentials and access all roles without any restrictions. This vulnerability is due to exposed sensitive Security Assertion Markup Language SAML metadata. An...
8x8: CVE-2019-11248 on http://█.█.█.█:9100/debug/pprof/goroutine
@mrk0anti reported to us an exposed debugging endpoint /debug/pprof over the unauthenticated Kubelet healthz port 9100. No sensitive information has been disclosed & the affected host belonged to our staging environment. The issue has been rectified...
MAL-2022-6667 Malicious code in tslint-playground (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b487c30209288915a78a54104205552e07c0667d4111beb89f0b27dcbb3e90af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-930 Malicious code in alfaform-core-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b774927a44e0387b65b7440c9ed8179b099a96cc5dc65b2cd515347298ca7fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3592 Malicious code in helix-rum-collector (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 002b86a6a7d367dc196dbac6c12dff9827ed2b0a483cb8520063a9f3e90c513b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-2345 Malicious code in datadog-app-example-random-dog-dog-image-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b50dcc4d3984665cd138c5e4d7a07df4b4516229793751b28f80309508902d51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students
By Deeba Ahmed The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus. SafetyDetectives’ cybersecurity research team… This is a post from HackRead.com Read the original post: Elasticsearch Database Mess Up Exposed Login, PII Data of...
CVE-2022-31060
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
CVE-2022-31060 Banner topic data is exposed on login-required Discourse sites
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
CVE-2022-33174
Power Distribution Units running on Powertek firmware multiple brands before 3.30.30 allows remote authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an emp...
PT-2022-19180 · Rakuten · Rakuten Casa
Name of the Vulnerable Software and Affected Versions: Rakuten Casa versions AP F V1 4 1 through AP F V2 0 0 Description: The issue is related to improper access control, allowing a remote attacker to log in with root privilege and perform arbitrary operations if the product is in its default...
Couchbase Server 安全漏洞
Couchbase Server is a distributed NoSQL non-relational database from Couchbase USA, which primarily supports data query, full-text search, and active global replication. information disclosure vulnerability exists in versions of Couchbase Server prior to 7.0.4, which stems from the fact that samp...
CVE-2022-30703
Trend Micro Security 2021 and 2022 Consumer is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation...
CVE-2022-30703
Trend Micro Security 2021 and 2022 Consumer is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation...
CVE-2022-30703
Trend Micro Security 2021 and 2022 Consumer is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation...
CVE-2021-42886
TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file...
CVE-2021-42886
TOTOLINK EX1200T V4.1.2cu.5215 contains an information disclosure vulnerability where an attacker can get the apmib configuration file without authorization, and usernames and passwords can be found in the decoded file...
Vulnerability fixed in IBM Spectrum Protect Plus
IBM has fixed a vulnerability in Spectrum Protect Plus. Credentials of users are printed in readable text in the IBM Spectrum Protect Plus virgo log file. IBM has released updates to fix the vulnerabilities in Spectrum Protect Plus 10.1.0.0-10.1.9.32. For more information, see:...