5446 matches found
Securing Your Web App, One Robot at a Time
Modern web apps are two things: complex, and under persistent attack. Any publicly accessible web application can receive up to tens of thousands of attacks a month. While that sounds like a reason to immediately pull the plug and find a safe space to hide, these are likely spread across the...
Misconfigured baby monitors exposing video stream online
By Habiba Rashid A vulnerability in baby monitors due to their misconfiguration could potentially allow dangerous parties to have access to the camera’s video stream. This is a post from HackRead.com Read the original post: Misconfigured baby monitors exposing video stream online...
The vulnerability of the HTTP/2 mechanism implemented in the Apache HTTP Server allows attackers to cause service failures or lead to incorrect server configurations.
The vulnerability of the HTTP/2 web server implementation in the Apache HTTP Server is related to inconsistent interpretation of http requests. Exploiting this vulnerability can allow a malicious actor to cause service failures or lead to incorrect server configuration...
Atlassian Jira Server 和 Data Center 信息泄露漏洞
Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. An information disclosure vulnerability exists in Atlassian Jira Server and Data Center, which arises from errors such as...
8x8: DNS Misconfiguration (Subdomain Takeover) ███████.8x8.com
An EC2 instance was replaced but the DNS record was initially not updated/removed. The issue has been rectified. https://medium.com/bugbountywriteup/dangling-dns-aws-ec2-e2d801701e8...
Wire Information Disclosure Vulnerability
Wire is a chat software by an individual developer. The software supports Web, WindowsiOS, Android, and OS X platforms, has a group feature, allows voice calls, sends photos, and its original greeting method, PING. An information disclosure vulnerability exists in Wire, which is caused by a...
CVE-2021-20409
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...
Design/Logic Flaw
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
NCR Command Center Agent Remote Code Execution
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. The...
Spotify Suffers Second Credential-Stuffing Cyberattack
Spotify streaming music aficionados are in the crosshairs of yet another credential-stuffing cyberattack, just three months after the last one. The service has forced password resets for impacted users. Cybercriminals carrying out credential-stuffing take advantage of people who reuse the same...
CVE-2021-1243
A vulnerability in the Local Packet Transport Services LPTS programming of the SNMP with the management plane protection feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker to allow connections despite the management plane protection that is configured to deny access ...
U.S. Dept Of Defense: Bypassing CORS Misconfiguration Leads to Sensitive Exposure at https://███/
Summary: It's possible to get information about the users registered such as: id, name, login name, etc. without authentication in WordPress via API on https://██████████/. Description: There exists a cross-origin resource sharing CORS misconfiguration vulnerability at https://█████/, allowing...
8x8: DNS Misconfiguration (Subdomain Takeover) ███.wavecell.com
An S3 bucket was deleted, but a DNS record pointing to the bucket was initially not updated/removed. The issue has been rectified...
DRUPAL-CONTRIB-2021-003
This module enables you to add groups to other groups in a tree structure where access can be inherited up or down the tree. When you configure Subgroup to have a tree with at least three levels, users may inadvertently get permissions in a group that is an uncle or cousin of the source group,...
23M Gamer Records Exposed in VIPGames Leak
VIPGames.com, a free platform with a total of 56 available classic board and card games like Hearts, Crazy Eights, Euchre, Dominoes, Backgammon and others, has exposed the personal data of tens of thousands of users. In all, more than 23 million records for more than 66,000 users were left expose...
GHSA-FXWF-4RQH-V8G3 CORS misconfiguration in socket.io
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
CORS misconfiguration in socket.io
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...
