5434 matches found
The vulnerability of Google Chrome’s browser, related to security configuration errors, allows a malicious actor to gain unauthorized access to local files.
The vulnerability of Google Chrome is related to security settings errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to local files through a specially created Chrome extension...
SAP NetWeaver Application Server Java Information Disclosure Vulnerability
SAP NetWeaver Application Server Java is a German SAP SAP company provides a Java runtime environment of the application server. The product is mainly used to develop and run Java EE applications. An information disclosure vulnerability exists in SAP NetWeaver Application Server Java. The...
CORStest - A Simple CORS Misconfiguration Scanner
A simple CORSmisconfiguration scanner Based on theresearch of James Kettle CORStest is a quick & dirty Python 2 tool to find Cross-Origin Resource Sharing CORS misconfigurations. It takes a text file as input which may contain a list of domain names or URLs. Currently, the following potential...
AT&T, Verizon Subscribers Exposed as Mobile Bills Turn Up on the Open Web
Hundreds of thousands of mobile phone bills for AT&T, Verizon and T-Mobile subscribers have been laid open to anyone with an internet connection, thanks to the oversight of a contractor working with Sprint. According to a media investigation, the contractor misconfigured a cloud storage bucket on...
New Relic: NR-wide cross account access through misconfigured CORS-policy of multiple endpoints
Hey guys, While working at 746786, I've discovered a NewRelic-wide huge CORS-policy misconfiguration leading to cross-account data stealing and modification at a huge amount of endpoints. The vulnerability itself is that origin nr3.nr-assets.net is trusted NR-widely at many different endpoints, b...
The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows a hacker to gain unauthorized access to local files.
The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files through a specially created HTML page...
The vulnerability in the implementation of the FileSessionDataStore class for the Jetty HTTP server allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the FileSessionDataStore class implementation in the Jetty HTTP server is related to a configuration error in J2EE. Exploiting this vulnerability allows an attacker, operating remotely, to gain unauthorized access to protected information by managing sessions using the...
CVE-2019-19014
An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root privileges by an attacker with access...
Multiple Kaspersky Products Information Disclosure Vulnerability (CNVD-2020-01949)
Kaspersky Anti-Virus is a suite of antivirus programs, Kaspersky Internet Security is a suite of security software with both anti-virus and firewall features, Kaspersky Total Security is a suite of full-featured security software, and Kaspersky Internet Security is a suite of security software wi...
New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration
Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...
DEBIAN-CVE-2019-14822
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...
Exploit for CVE-2019-19268
CVE-2019-19268 Affected Version: rConfig 3.9.2. Descriptio...
CVE-2019-14822
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...
CVE-2019-14822
A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...
CVE-2019-14822
CVE-2019-14822 — ibus local privilege/information exposure . A misconfiguration in the DBus server setup in ibus (versions before 1.5.22) allows any unprivileged user to monitor and send method calls to the ibus bus of another user via the UNIX socket, enabling interception of keystrokes and pote...
ZTE ZXCDN IAMWEB Misconfiguration Vulnerability
ZTE ZXCDN IAMWEB is an authentication product from ZTE Corporation ZTE, China. A configuration error vulnerability exists in ZTE ZXCDN IAMWEB version 6.01.03.01. The vulnerability stems from the existence of unreasonable file configuration, parameter configuration, etc. during the use of a networ...
Shopify: Shopify Stocky App OAuth Misconfiguration
@vulnh0lic noticed that a staff member without Apps permission was able to access the Stocky app. We determined that this was because of a bug in Stocky's OAuth authentication code, which allowed the user to be granted access to Stocky at the start of the OAuth process rather than the end. This...
CVE-2013-4657
Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service...
CVE-2013-4657
The CVE-2013-4657 entry describes a Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L caused by misconfiguration in the SMB service. Affected product(s): NETGEAR WNR3500U and WNR3500L routers. Reported impact in the sources indicates high severity, with the vulnerability enabling p...