Azure Red Flag: Microsoft Accidentally Fixes Cloud Config ‘Bug’

UPDATE Researchers are shedding light on a Microsoft Azure misconfiguration bug that leaked sensitive access tokens, which could have given hackers access to virtual machine instances and cloud-based storage buckets. Since its discovery, an update has fixed what researchers said was a...

Azure Red Flag: Microsoft Accidentally Fixes Cloud Config ‘Bug’

UPDATE Researchers are shedding light on a Microsoft Azure misconfiguration bug that leaked sensitive access tokens, which could have given hackers access to virtual machine instances and cloud-based storage buckets. Since its discovery, an update has fixed what researchers said was a...

PayloadsAllTheThings

This repository is an offensive tool for Web Application Security and Pentest/CTF. It contains a list of useful payloads and bypass for various web application security vulnerabilities and penetration testing. The repository includes tools and exploits for vulnerabilities such as CRLF injection,...

PlayStation: Access token stealing.

Summary: https://my.playstation.com/auth/response.html suffers from a misconfiguration which leads to access token stealing. Description: The page...

CVE-2020-6584

Nagios Log Server 2.1.3 has Incorrect Access Control...

Mail.ru: [api.33slona.ru] Доступ к API из за неправильной конфигурации сервера 302 редирет.

A 302 reply for non-authenticated request to api.33slona.ru could leak some static content with HTML body...

Fortinet FortiWeb Information Disclosure Vulnerability (CNVD-2020-17958)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content. A...

Intel MAX 10 FPGA Information Disclosure Vulnerability

Intel MAX 10 FPGA is a specialized integrated circuit development board from Intel Corporation. An information disclosure vulnerability exists in the Intel MAX 10 FPGA that arises from a misconfiguration in the block design. The vulnerability can be exploited by an attacker to elevate privileges...

ABB eSOMS Information Disclosure Vulnerability (CNVD-2020-17169)

ABB eSOMS is a plant operations management system from ABB Switzerland. An information disclosure vulnerability exists in ABB eSOMS 6.0.3 and prior versions. The vulnerability arises from an error in the configuration, etc. of a networked system or product during operation. An unauthorized attack...

Authentication Leak On Redirect With Reactor Netty HttpClient

Reactor Netty HttpClient, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects...

MGM Grand Breach Leaked Details of 10.6 Million Guests Last Summer

A hacking forum this week published details of more than 10.6 million guests who stayed at MGM Resorts, the result of a breach due to unauthorized access to a cloud server that occurred at the famous Las Vegas hotel and casino last summer. The incident—revealed in a published report on ZDNet...

CVE-2020-3944

vRealize Operations for Horizon Adapter 6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1 has an improper trust store configuration leading to authentication bypass. An unauthenticated remote attacker who has network access to vRealize Operations, with the Horizon Adapter running, may be able to bypa...

Mirumee Saleor Information Disclosure Vulnerability

Mirumee Saleor is a modular e-commerce platform. An information disclosure vulnerability exists in Mirumee Saleor. The vulnerability arises due to a configuration or other error in the operation of a networked system or product. An unauthorized attacker could exploit the vulnerability to obtain...

Security Bulletin: WebSphere Dashboard Framework contains a vulnerability that allows file access and deletion.

Summary WebSphere Dashboard Framework contains a vulerability in a charting feature used to access and delete generated images in a temporary folder. A fix has been created that removes the vulnerability. Vulnerability Details WebSphere Dashboard Framework contains a vulnerability in a charting...

GitLab EE Memory Corruption Vulnerability

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab EE. The...

GitLab Information Disclosure Vulnerability (CNVD-2020-05079)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab Information Disclosure Vulnerability (CNVD-2020-05083)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab Information Disclosure Vulnerability (CNVD-2020-05081)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

GitLab Information Disclosure Vulnerability (CNVD-2020-05082)

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

Design/Logic Flaw

An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct configuration in the server's sudoers file, which by default allows the execution of programs e.g. nmap without the need for a...