Hyperledger: Insecure TLS Configuration #3530

An insecure configuration was reported; however, this configuration is set on purpose in test code. Please see the resolved conversation on GitHub...

CVE-2014-8164

CVE-2014-8164 describes an insecure certificate verification configuration (http.verify_mode = OpenSSL::SSL::VERIFY_NONE) that may enable verification bypass in Red Hat CloudForms 5.x. The connected documents corroborate that the issue affects the CloudForms Management Engine and related componen...

CVE-2014-8164

A insecure configuration for certificate verification http.verifymode = OpenSSL::SSL::VERIFYNONE may lead to verification bypass in Red Hat CloudForms 5.x...

Red Hat CloudForms Management Engine 信任管理问题漏洞

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure-as-a-Service cloud service solutions from Red Hat, USA. A security vulnerability exists in the Red Hat CloudForms Management Engine that stems from an insecure configuration of certificate validation...

CVE-2022-28704

Improper access control vulnerability in Rakuten Casa version APFV141 or APFV200 allows a remote attacker to log in with the root privilege and perform an arbitrary operation if the product is in its default settings in which is set to accept SSH connections from the WAN side, and is also connect...

HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

GHSA-XRH2-C3RM-35JR HornetQ REST vulnerable to Improper Restriction of XML External Entity Reference

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

GHSA-JFCH-M2X3-2V66 Liferay Portal and Liferay DXP insecure default configuration

Insecure default configuration in portal services implementation before 5.11.0 in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should ...

VMware Spring Cloud Gateway 代码注入漏洞

Spring Cloud GateWay is a library provided for building API gateways on top of Spring WebFlux.A remote code execution vulnerability exists in Spring Cloud Gateway, which occurs in the Actuator endpoint of the Spring Cloud Gateway application, which is enabled, public and insecure, is vulnerable t...

Mageia: Security Advisory (MGASA-2020-0310)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2022-6902 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex version 5.0.5 Description: The issue is related to an insecure configuration in the application, which may allow a remote attacker to gather sensitive information about the web application. This is due to insufficient...

CVE-2021-45641

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...

Riak Insecure Default Configuration / Remote Command Execution Vulnerabilities

Riak runs as an Erlang service configured with a default cookie of riak that allows for remote command execution if not modified before use. Riak KV Insecure Default Cookie RCE ===== Intro ===== Riak is a NoSQL key-value database that is built to maximize data availability and performance,...

CVE-2021-33321

Insecure default configuration in Liferay Portal 6.2.3 through 7.3.2, and Liferay DXP before 7.3, allows remote attackers to enumerate user email address via the forgot password functionality. The portal.property login.secure.forgot.password should be defaulted to true...

Insecure SSL Configuration

curl uses insecure SSL configurations. The curlsslconfigmatches attempts to compare whether two SSL connections have identical SSL security options and could potentially reuse a connection that is less secure or uses different security options such as capath, cainfo or certificate/issuer pinning...

Default configuration

Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used which is recommended, but is n...

Vulnerability of the Services and Controller applications on Windows operating systems, allowing attackers to increase their privileges

The vulnerability of the Services and Controller applications for Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow attackers to enhance their privileges...

Insecure Configuration

Overview Affected versions of this package are vulnerable to Insecure Configuration. JavaScript inserted as part of a test has the ability to execute arbitrary code due to contextIsolation setting not being set within webpreferences. PoC js Hallo Details Cross-site scripting or XSS is a code...

CVE-2020-36319

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController...

CVE-2020-36319 Potential sensitive data exposure in applications using Vaadin 15

Insecure configuration of default ObjectMapper in com.vaadin:flow-server versions 3.0.0 through 3.0.5 Vaadin 15.0.0 through 15.0.4 may expose sensitive data if the application also uses e.g. @RestController...