CVE-2023-3485

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

Race condition

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485

CVE-2023-3485 (Temporal Server) : The Temporal Server (before v1.20) has insecure defaults that allow an attacker to craft a task token giving access to a namespace other than the one in the request. The token must be created outside the normal Temporal server flow and requires the target namespa...

CVE-2023-3485

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

Insecure Default Initialization of Resource

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

CVE-2023-21220

there is a possible use of unencrypted transport over cellular networks due to an insecure default value. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroi...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from insecure defaults that may use unencrypted transmissions over cellular networks, which could lead to remote information leaks...

Google Pixel security vulnerabilities

Google Pixel is a smartphone from the American company Google Google. Google Pixel has a security vulnerability that stems from insecure defaults that may use unencrypted transmissions over cellular networks, which could lead to remote information leaks...

Databricks Platform Cluster Isolation Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Bypassing cluster isolation through insecure defaults and shared storage product: Databricks Platform vulnerable version: PaaS version as of 2023-01-26 fixed version:...

HTTP::Tiny Trust Management Vulnerability

HTTP::Tiny is a small, simple, and correct HTTP/1.1 client from Perldoc Open Source. HTTP::Tiny suffers from a trust management issue vulnerability that stems from having an insecure default TLS configuration where users must opt-in to validate certificates...

Insecure Defaults

Overview fluentd-ui is a web UI for Fluentd Affected versions of this package are vulnerable to Insecure Defaults in the form of a default password, which is not mandatory to change. Remediation There is no fixed version for fluentd-ui. References - GitHub Issue...

CVE-2022-3101

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of...

SUSE CVE-2019-3700

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger...

WordPress Plugin SVG Support Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...

CVE-2022-39395 Vela Insecure Defaults

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to...

GHSA-5M7G-PJ8W-7593 Vela Insecure Defaults

Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...

Red Hat OpenStack Platform security vulnerabilities

Red Hat OpenStack Platform is a cloud computing management platform from the US-based Red Hat, Inc. A security vulnerability exists in Red Hat OpenStack Platform versions 16.1 and 16.2, which stems from an insecure default configuration in Tripleo-ansible, where permissions on sensitive files are...

Red Hat OpenStack Platform security vulnerabilities

Red Hat OpenStack Platform is a cloud computing management platform from the US-based Red Hat, Inc. A security vulnerability exists in Red Hat OpenStack Platform versions 16.1 and 16.2, which stems from an insecure default configuration in Tripleo-ansible, where permissions on sensitive files are...