CVE-2025-44021

OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling if a deployment was performed via the API. A malicious project assigned as a node owner can provide a path to any local file readable by ironic-conductor, which may then be written to the target...

CVE-2025-44021

OpenStack Ironic prior to 29.0.1 is vulnerable to a local-file write during image handling when a deployment is performed via the API. A malicious project assigned as a node owner can supply a path to a local file (readable by ironic-conductor), which may then be written to the target node’s disk...

PT-2025-23104

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8 Description Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave...

CVE-2024-48122

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges...

CVE-2024-48122

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges...

CVE-2024-48122

CVE-2024-48122 concerns the Smiths Detection HI-SCAN 6040i Hitrax HX-03-19-I, where insecure default configurations enable an authenticated attacker with low privileges to escalate to root. The connected sources consistently describe the issue as an insecure default setup that permits local privi...

CVE-2024-48122

Insecure default configurations in HI-SCAN 6040i Hitrax HX-03-19-I allow authenticated attackers with low-level privileges to escalate to root-level privileges...

Securing Cloud Environments Against Potential Extortion Threats

Introduction With the growing reliance on cloud infrastructure, organizations must be vigilant against potential extortion threats targeting misconfigurations and weak access controls. Unfortunately, extortion threats are a huge problem. According to the Verizon 2024 Data Breach Investigations...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

Permissive Cross-domain Policy With Untrusted Domains

Fiber is vulnerable to Permissive Cross-domain Policy with Untrusted Domains. The vulnerability is due to insecure configurations, specifically allowing the Access-Control-Allow-Origin header to be set to a wildcard while also setting Access-Control-Allow-Credentials to true, contrary to...

CVE-2024-25124

Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard whil...

Design/Logic Flaw

Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard whil...

CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard whil...

CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials

Fiber is a web framework written in go. Prior to version 2.52.1, the CORS middleware allows for insecure configurations that could potentially expose the application to multiple CORS-related vulnerabilities. Specifically, it allows setting the Access-Control-Allow-Origin header to a wildcard whil...

Fiber Security Breach

Fiber is an open source web framework written in the Go language. A security vulnerability exists in Fiber versions prior to 2.52.1 that stems from allowing insecure configurations that could lead to unauthorized access to sensitive user data...

The vulnerability of the VPN server of the Ivanti Secure Access Client (ISAC) for corporate networks (formerly known as Pulse Secure Desktop Client) on Windows operating systems arises from the use of insecure configurations. This vulnerability allows attackers to gain unauthorized access to protected information, increase their privileges, or cause service interruptions.

The vulnerability of the VPN server of Ivanti Secure Access Client formerly Pulse Secure Desktop Client for Windows operating systems is related to the use of insecure configurations. Exploiting this vulnerability can allow attackers to gain unauthorized access to protected information, increase...

The vulnerabilities of the MC990 X and UV300 server microprogramming systems are related to insecure configurations, allowing attackers to increase their privileges.

The vulnerability of the MC990 X and UV300 server microprogramming systems is related to insecure configurations. Exploiting this vulnerability can allow a malicious actor to gain increased privileges remotely...

Cross site request forgery (csrf)

Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery CSRF due to lack of validation and insecure configurations in inputs and modules...

CVE-2021-32402

CVE-2021-32402 affects Intelbras Router RF 301K Firmware 1.1.2. The vulnerability is a Cross Site Request Forgery (CSRF) caused by lack of input validation and insecure configurations in inputs and modules. The impact is described as CSRF, with no publicly documented exploit details in the provid...

CVE-2020-10279

CVE-2020-10279 is mapped to MiR robot software with insecure default permissions (Incorrect Default Permissions CWE-276) in MiR robots shipped prior to v2.8.3. The vulnerability description notes that an authorized local attacker with access to the robot operating system could perform privilege e...