CVE-2020-26541

CVE-2020-26541 : Local attacker can bypass the Secure Boot Forbidden Signature Database (dbx) protection in Linux kernels up to 5.8.13, affecting certs/blacklist.c and certs/system_keyring.c. Impact involves potential system integrity/confidentiality compromise. Connected sources confirm the issu...

U.S. Dept Of Defense: 403 Forbidden Bypass at www.██████.mil

Hi team, I managed to bypass 403 forbidden pages in www.████████.mil Reproduce 1 Click https://www.████████.mil/███████ Example Forbidden page. If you click you will redirect to 403 "forbidden" page. 2 But you can bypass this. 3 type this command: curl -H "Content-Length:0" -X POST...

Information disclosure

A potential security vulnerability has been identified in HPE Intelligent Provisioning, Service Pack for ProLiant, and HPE Scripting ToolKit. The vulnerability could be locally exploited to allow arbitrary code execution during the boot process. Note: This vulnerability is related to using insmod...

HPESBHF04022 rev.1 - Superdome Flex Servers with Secure Boot enabled and GRUB2 vulnerability, Local Arbitrary Code Execution

Potential Security Impact: Local: Arbitrary Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Superdome Flex Server Version 3.25.46 May 12 2020 or earlier CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2020-10713 |...

CVE-2020-10287

The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default...

squid: improper access restriction upon Digest Authentication nonce replay could lead to remote code execution

A flaw was found in Squid, where a remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This issue occurs because the attacker can overflow the nonce reference counter, which results in remote code execution if the pooled token...

Design/Logic Flaw

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter a short integer. Remote code execution may occur if...

SharePoint Online and OneDrive for Business Backup Jobs Fail with (403) Forbidden Warning Message

Challenge SharePoint Online or OneDrive for Business backup jobs fail with the following message: Processing site https://site.sharepoint.com/sites/111/subsite finished with warning: Failed to backup item version: //1024/Shared Documents/, version: 1.0, The remote server returned an error: 403...

Nord Security: Password Reset Link Works Multiple Times

Background: Normally, a secure way to handle password reset links is to invalidate the link/token upon usage. Additionally, if multiple reset links are requested, older & unused tokens should also be invalidated i.e., if 2 reset tokens were requested, the 2nd token should be invalid upon your usa...

Clario: Bypass front server restrictions and access to forbidden files and directories through X-Rewrite-Url/X-original-url header on account.mackeeper.com

Summary Normally a client can't access /admin directory because of front nginx server which returns 403. But we can use X-Rewrite-Url or X-original-url because back server processes these headers and front server doesn't. Steps to reproduce: This request shows normal behavior curl -i -s -k -X...

CVE-2007-5743

viewvc 1.0.3 allows improper access control to files in a repository when using the "forbidden" configuration option...

CVE-2007-5743

CVE-2007-5743 affects viewvc 1.0.3 and allows improper access control to files in a repository when using the "forbidden" configuration option. NVD lists CVSS‑2 base 4.3 (Network, Medium) and CVSS‑3.1 base 7.5 (Network, Low‑Impact? actually C:H I:N A:N) with confidentiality impact High; other imp...

CVE-2007-5743

Removed by vendor...

Security Bulletin: IBM Cloud Automation Manager is affected by a forbidden resouce redirect for bad API path CVE-2019-4132

Summary IBM Cloud Automation Manager will redirect when a bad API path is requested rather than issuing a 404. User may expect an error but be redirected to a home page instead. Vulnerability Details CVEID: CVE-2019-4132 DESCRIPTION: IBM Cloud Automation Manager could allow a user to be impropert...

Zimbra Collaboration Suite ProxyServlet SSRF

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details According to the blog post A Saga of...

Mail.ru: Seven DOM-Based XSS Vulnerabilities | Execution in Login Sequence

DOM based XSS in tz.mail.ru tz.mail.ru belongs to extended scope I was able to exploit DOM XSS at the following endpoints. The vulnerability was exploitable on forbidden pages and the root cause lies in jquery. text https://tz.mail.ru/a/ https://tz.mail.ru/a/js/ https://tz.mail.ru/www/...

Nextcloud: Content spoofing on https://surveyserver.nextcloud.com

Hi NextCloud team, the https://surveyserver.nextcloud.com domain is vulnerable against content spoofing in the forbidden page due to the fact that the request URI is reflected without validation inside the aforementioned page. 1. Go on...

Citrix Director error "403 Forbidden : access is denied"

When you try to access Director URL in the browser, there is an error displayed: Server Error - 403 - Forbidden: Access Denied...

Design/Logic Flaw

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local...

CVE-2018-12596

Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden normally available exclusively for local...