171 matches found
BIT-PARSE-2023-22474 Parse Server is vulnerable to authentication bypass via spoofing
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server wi...
SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2024:0329-2)
The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:0329-2 advisory. - CVE-2023-27043: Fixed incorrectly parses e-mail addresses which contain a special character bsc1210638. Tenable has extracted the preceding descripti...
IBM PowerSC Information Disclosure Vulnerability (CNVD-2024-09941)
IBM PowerSC is an International Business Machines IBM security and compliance solution for IBM Power Systems servers. An information disclosure vulnerability exists in IBM PowerSC that stems from MFA not implementing the HSTS security policy mechanism, which can be exploited by an attacker to cau...
Cleartext Transmission Of Sensitive Information
firefox is vulnerable to Cleartext Transmission Of Sensitive Information. The vulnerability is due to improper handling of HSTS configurations, allowing an attacker to bypass the security mechanism on a subdomain...
The vulnerability of the Fortra (HelpSystems) GoAnywhere MFT application for secure file transfer, related to security mechanism errors, allows attackers to escalate their privileges.
The vulnerability of the Fortra HelpSystems GoAnywhere MFT application for secure file transfer is related to security mechanism errors. Exploiting this vulnerability allows a malicious actor to enhance their privileges by creating a user administrator through the administration portal...
The vulnerability of the Autoptimize plugin of the WordPress content management system, related to security mechanism errors, allows attackers to gain unauthorized access to information.
The vulnerability of the Autoptimize plugin of the WordPress content management system is related to security mechanism errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to information...
CVE-2023-49298
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...
CVE-2023-49298
OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...
The vulnerability of Siemens SCALANCE industrial switches’ microprogramming software, related to security mechanism errors, allows a intruder to alter the user interface.
The vulnerability of Siemens SCALANCE industrial switches’ microprogramming software is related to security mechanism errors. Exploiting this vulnerability could allow a malicious actor to alter the user interface remotely...
PT-2023-24837 · Soar Cloud · Soar Cloud Ltd. Hr Portal
Name of the Vulnerable Software and Affected Versions: Soar Cloud Ltd. HR Portal affected versions not specified Description: The issue concerns a weak Password Recovery Mechanism for Forgotten Password in the Soar Cloud Ltd. HR Portal. The reset password link sent out through e-mail remains vali...
Microsoft Teams Flaw Sends Malware to Employees’ Inboxes
By Deeba Ahmed During their test, researchers from JUMPSEC managed to trick Microsoft Teams security mechanism into sending malware to the… This is a post from HackRead.com Read the original post: Microsoft Teams Flaw Sends Malware to Employees Inboxes...
Arbitrary Code Execution in Apache BRPC
Description BRPC is an Industrial-grade RPC framework using C++ Language, which is often used in high performance system such as Search, Storage, Machine learning, Advertisement, Recommendation etc. In server.cpp there are function call to wordexp, it used for expanding path from user input. Due ...
Account Lockout
phpmyfaq is vulnerable to Account Lockout. A remote attacker is able to bypass the security mechanism due to improper input validation in the E-Mail field, which may lead to an account takeover or an account lockout without any possibility of recovery...
CVE-2023-22474
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server wi...
CVE-2023-22474 Parse Server is vulnerable to authentication bypass via spoofing
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server wi...
GHSA-VM5R-C87R-PF6X Parse Server option `masterKeyIps` vulnerability to IP spoofing
Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...
Parse Server option `masterKeyIps` vulnerability to IP spoofing
Impact Parse Server uses the request header x-forwarded-for to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various feature...
important E-Mail Input Field bypassed allowing Account Lockout and Takeover
Dear Ladies and Gentlemen, First of all, thank you for your time and effort in reading my Report. While doing the Penetration Test my Brother Josef Hassan [email protected] and I were able to Account Lockout Vulnerability by bypassing the Input of the E-Mail Address. The Process of...
Information Disclosure
openjdk is vulnerable to Information Disclosure. The vulnerability exists due to lack of validate untrusted code in Java applets which allows to remote attacker to bypass security mechanism and access the sensitive information...