CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

PT-2022-9172 · Red Hat · Openshift Container Platform 4

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform 4 affected versions not specified Description: It was found that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623...

PHPUnit Command Injection Vulnerability

PHPUnit allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI...

CVE-2021-39935

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API...

Schneider Electric Software Update 安全特征问题漏洞

Schneider Electric Software Update is a software update tool for Schneider Electric products from Schneider Electric France. A security signature issue vulnerability exists in Schneider Electric Software Update SESU that stems from An entropy insufficiency vulnerability exists in Schneider Electr...

Files or Directories Accessible to External Parties

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem...

The vulnerability of the index.php file of the Nagios XI monitoring tool allows a hacker to disclose protected information.

The vulnerability of the index.php file used by the Nagios XI monitoring tool is related to the use of files and directories accessible from external parties. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information that is protected by the system...

Design/Logic Flaw

An issue was discovered in PrimeKey EJBCA before 7.6.0. The General Purpose Custom Publisher, which is normally run to invoke a local script upon a publishing operation, was still able to run if the System Configuration setting Enable External Script Access was disabled. With this setting disable...

CVE-2021-22769

A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Easergy T300 with firmware V2.7.1 and older that could expose files or directory content when access from an attacker is not restricted or incorrectly restricted...

PT-2021-14328 · Weidmüller · Iot-Gateways +1

Name of the Vulnerable Software and Affected Versions: Weidmüller u-controls and IoT-Gateways versions up to 1.12.1 Description: A network port intended for device-internal usage is accidentally accessible via external network interfaces, allowing the device to be manipulated or its operation to ...

CVE-2021-20238

It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint port 22623 provides ignition configuration used for bootstrapping Nodes and can include some sensitive data,...

Security feature bypass

We have resolved a security issue in the camera plugin that could have affected certain Cordova Android applications. An attacker who could install or lead the victim to install a specially crafted or malicious Android application would be able to access pictures taken with the app externally...

CVE-2020-11990

We have resolved a security issue in the camera plugin that could have affected certain Cordova Android applications. An attacker who could install or lead the victim to install a specially crafted or malicious Android application would be able to access pictures taken with the app externally...

CVE-2020-27610

The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...

CVE-2020-27610

The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...

Design/Logic Flaw

The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...

CVE-2020-27610

The installation procedure in BigBlueButton before 2.2.28 or earlier exposes certain network services to external interfaces, and does not automatically set up a firewall configuration to block external access...

CVE-2020-24312

mndpsingh287 WP File Manager v6.4 and lower fails to restrict external access to the fmbackups directory with a .htaccess file. This results in the ability for unauthenticated users to browse and download any site backups, which sometimes include full database backups, that the plugin has taken...