1118 matches found
Vulnerability of the web-API service provided by Junos routers of the NFX Series and SRX Series; allowing attackers to obtain the secret key for the web-API service
The vulnerability of the web-API service of Junos router series NFX and SRX is related to errors in managing cryptographic keys. Exploiting this vulnerability can allow an attacker to obtain the secret key for the web-API service...
Red Hat Satellite 6 Information Disclosure Vulnerability
Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. An information disclosure vulnerability exists in Red Hat Satellite. The...
Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP plugin and retrieve the clientsecret key needed to...
WordPress Ninja Forms Contact Form plugin <= 3.4.33 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure vulnerability
Authenticated SendWP Plugin Installation and Client Secret Key Disclosure vulnerability found by Chloe Chamberland in WordPress Ninja Forms Contact Form plugin versions = 3.4.33. Solution Update the WordPress Ninja Forms Contact Form plugin to the latest available version at least 3.4.34...
Ninja Forms < 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure
The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP plugin and retrieve the clientsecret key needed to...
Adobe Magento Commerce Cross Site Scripting
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Reflected Cross-Site Scripting XSS product: Adobe Magento Commerce vulnerable version: 2.4.2 fixed version: 2.4.2 CVE number: CVE-2021-21029 impact: Medium homepage:...
Mail.ru: Debug Mode Leak Critical Information [ AWS Keys , SMTP , Database , Django Secret Key ( RCE ) , Dodoc , Telegram , Twilio .. ]
Debug mode was enabled in legium-back.corp.mail.ru leaking some potenitially sensitive information Debug mode was enabled in legium-back.corp.mail.ru leaking some potenitially sensitive information...
Insecure Default Secret Key
apache-airflow uses an insecure default secret key. A default value for secretkey is set prior to creation of the application, allowing any user to gain unauthorized access to the application if the default secret key is not changed...
PYSEC-2020-22
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...
PYSEC-2020-22
Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...
PT-2020-6687 · Apache · Apache Airflow
Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.14 Description: The issue is related to incorrect session validation in the Apache Airflow web server, caused by the use of a default configuration that includes a pre-set secret key. This allows a...
How the SolarWinds Hackers Bypassed Duo’s Multi-Factor Authentication
This is interesting: Toward the end of the second incident that Volexity worked involving Dark Halo, the actor was observed accessing the e-mail account of a user via OWA. This was unexpected for a few reasons, not least of which was the targeted mailbox was protected by MFA. Logs from the Exchan...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
Authentication flaw
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
CVE-2020-27508
In two-factor authentication, the system also sending 2fa secret key in response, which enables an intruder to breach the 2fa security...
GitLab File Read Remote Code Execution
This module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails "secretkeybase", and gains remote code execution with a deserialization vulnerability of a signed 'experimentationsubjectid' cookie tha...
GitLab File Read Remote Code Execution Exploit
This Metasploit module provides remote code execution against GitLab Community Edition CE and Enterprise Edition EE. It combines an arbitrary file read to extract the Rails secretkeybase, and gains remote code execution with a deserialization vulnerability of a signed experimentationsubjectid...
