GHSA-5CRP-9R3C-P9VR Improper Handling of Exceptional Conditions in Newtonsoft.Json

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service DoS. The serialization and...

Apache Wicket insecure defaults

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider...

GHSA-VFMM-JM4V-7FRQ Apache Wicket insecure defaults

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider...

Denial Of Service (DoS)

Newtonsoft.Json is vulnerable to denial of service. The use of insecure defaults cause an StackOverFlow exception SOE whenever nested expressions are being processed when an attacker sends 5 requests that cause SOE in time frame of 5 minutes...

Insecure Defaults

github.com/cri-o/cri-o is vulnerable to insecure defaults. The vulnerability exists because its containers started incorrectly with non-empty inheritable Linux process capabilities, allowing an unprivileged user to gain inheritable file capabilities up to the container's bounding set...

Insecure Defaults

directus is using insecure defaults. The use of default CORS settings in the Record function of env.ts which are very permissive for uncontrolled environments allows an attacker to access unauthorized resources in the system...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-28928)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from insecure defaults in miniadb. An attacker could exploit this vulnerability to cause a local elevation of privilege...

CVE-2021-39767

In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from insecure defaults in miniadb. An attacker could exploit this vulnerability to cause a local elevation of privilege...

Denial Of Service (DoS)

udisks2 is vulnerable to denial of service. The vulnerability exists because some user-accessible mount helpers use insecure defaults which allows an attacker to send a crafted image causing an application crash...

Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

GHSA-34P9-F4Q3-C4R7 Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

The vulnerability of the user management utilities useradd and adduser in the operating system “OSnova” lies in the use of insecure default settings, which allow attackers to gain access to protected information.

The vulnerability of the user management utilities useradd and adduser in the operating system is related to the use of insecure default settings. Exploiting this vulnerability can allow an attacker to gain access to protected information...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android has a security vulnerability where an eavesdropping vector may exist in onCreate of RequestPermissionActivity.java due to insecure default values. This could lead to a local...

Insecure Default Configuration

Overview Affected versions of socket.io are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Recommendation Update to version 2.4.0 or later. References - GitHub Advisory - Snyk Advisory...

Intel SSD Toolbox Default Configuration Issue Vulnerability

A Default Configuration Issue vulnerability exists in Intel SSD Toolbox that arises from the use of insecure default configurations on networked systems or products...

CentOS 8 : pki-deps:10.6 (CESA-2019:1529)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory. - tomcat: Open redirect in default servlet CVE-2018-11784 - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins...

GHSA-49WP-QQ6X-G2RF Cross-site Request Forgery in fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

Cross-site Request Forgery in fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

CORS misconfiguration in socket.io

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...