Automated remediation level 3: Governance and hygiene

Mold it, make it, just don’t fake it At a quick glance, it seems like the title of this blog is “government hygiene.” Most likely, that wouldn’t be a particularly exciting read, but we’re hoping you might be engaged enough to gain a few takeaways from this fourth piece in our series on automating...

DreamHost hosting firm exposed almost a billion sensitive records

By Habiba Rashid The database belonged to DreamHost's DreamPress managed WordPress hosting that was left exposed without any security authentication. This is a post from HackRead.com Read the original post: DreamHost hosting firm exposed almost a billion sensitive records...

CVS Health Records for 1.1 Billion Customers Exposed

More than 1 billion records for CVS Health customers were left in the database of a third-party, unnamed vendor – exposed, unprotected, online. Researchers said the data points revealed could be strung together to create an extremely personal snapshot of someones’s medical situation. The glitch i...

Privilege Escalation

ansible-tower is vulnerable to privilege escalation. The vulnerability exists due to application credentials exposed to playbook job runs via environment variables...

WordPress Duplicator / Duplicator Pro Plugin Installer File Exposed (HTTP)

One or more installer files of the WordPress plugins Duplicator / Duplicator Pro are exposed on the target system. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2021-34203

D-Link DIR-2640-US 1.01B04 is vulnerable to Incorrect Access Control. Router ac2600 dir-2640-us, when setting PPPoE, will start quagga process in the way of whole network monitoring, and this function uses the original default password and port. An attacker can easily use telnet to log in, modify...

TP-Link TL-WPA4220 信息泄露漏洞

Tp-link TP-Link TL-WPA4220 is a home wireless WiFi bridge that extends wireless signals from China's Tp-link. The device can transmit data at high speed over the line to extend the network to areas that are currently not covered. An information disclosure vulnerability exists in the TP-Link...

CVE-2021-23182

Cleartext Storage of Sensitive Information in Memory vulnerability in Gallagher Command Centre Server allows OSDP reader master keys to be discoverable in server memory dumps. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; All versions of 8.30...

PT-2021-14707 · Xebialabs +1 · Jenkins Xebialabs Xl Deploy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins XebiaLabs XL Deploy Plugin versions 10.0.1 and earlier Description: An incorrect permission check in the Jenkins XebiaLabs XL Deploy Plugin allows attackers with Generic Create permission to connect to an attacker-specified URL using...

PYSEC-2021-125

A flaw was found in Ansible where the secret information present in asyncfiles are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw affects Ansible Tower...

CVE-2020-28713

Incorrect access control in push notification service in Night Owl Smart Doorbell FW version 20190505 allows remote users to send push notification events via an exposed PNS server. A remote attacker can passively record push notification events which are sent over an insecure web request. The we...

Night Owl Smart Doorbell FW 安全漏洞

Night Owl Smart Doorbell FW is a smart doorbell from Night Owl USA. A security vulnerability exists in Night Owl Smart Doorbell FW version 20190505 that allows a remote user to send push notification events via an exposed PNS server...

CVE-2021-29099 There is a SQL injection vulnerability in ArcGIS Server

A SQL injection vulnerability exists in some configurations of ArcGIS Server versions 10.8.1 and earlier. Specially crafted web requests can expose information that is not intended to be disclosed not customer datasets. Web Services that use file based data sources file Geodatabase or Shape Files...

A flaw was found in ansible. Credentials such as secrets are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality. Versions before ansible 2.9.18 are affected.

...

Sourcecodester Online Shopping Alphaware SQL注入漏洞

Sourcecodester Online Shopping Alphaware is a Buffalo company Sourcecodester open source an online shopping system application . Sourcecodester Online Shopping Alphaware version 1.0 has a SQL injection vulnerability that can be exploited by an attacker to inject an executable SQL statement to...

CVE-2021-23019

The CVE-2021-23019 entry applies to NGINX Controller, affecting versions 2.0.0 through 2.9.0 and 3.x before 3.15.0. The root cause is exposure of the Administrator password in the systemd.txt file included in the NGINX support package. This credential exposure is the stated impact. Mitigation pro...

CVE-2021-23019

The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package...

CVE-2020-10729

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords a...

Red Hat Ansible 安全特征问题漏洞

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to publish, manage, and organize computer systems. A security vulnerability previously existed in Ansible version 2.9.6, which stemmed from a flaw discovered when the program was...

CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed

KL-001-2021-002: CommScope Ruckus IoT Controller Hard-coded API Keys Exposed Title: CommScope Ruckus IoT Controller Hard-coded API Keys Exposed Advisory ID: KL-001-2021-002 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-002.txt 1. Vulnerabilit...