2902 matches found
Anonymous users can view list of installed gadgets in Jira
h3. Issue Summary Endpoint "rest/config/1.0/directory" can be accessed anonymously. This page is an XML output that exposes the gadgets installed on the Jira instance. While there are not be any identifying information, user data, or anything else available to anonymous users if they hit this URL...
Anonymous users can view list of installed gadgets in Jira
h3. Issue Summary Endpoint "rest/config/1.0/directory" can be accessed anonymously. This page is an XML output that exposes the gadgets installed on the Jira instance. While there are not be any identifying information, user data, or anything else available to anonymous users if they hit this URL...
PT-2021-3816
Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server versions 2013 through 2019 Description The issue is related to errors in privilege management, allowing an attacker to elevate their privileges. This can affect the system and potentially lead to remote code execution...
New SaaS Security Report Dives into the Concerns and Plans of CISOs in 2021
For years, security professionals have recognized the need to enhance SaaS security. However, the exponential adoption of Software-as-a-Service SaaS applications over 2020 turned slow-burning embers into a raging fire. Organizations manage anywhere from thirty-five to more than a hundred...
Dozens of Vulnerable NuGet Packages Allow Attackers to Target .NET Platform
An analysis of off-the-shelf packages hosted on the NuGet repository has revealed 51 unique software components to be vulnerable to actively exploited, high-severity vulnerabilities, once again underscoring the threat posed by third-party dependencies to the software development process. In light...
Gorsair - Hacks Its Way Into Remote Docker Containers That Expose Their APIs
Gorsair is a penetration testing tool for discovering and remotely accessing Docker APIs from vulnerable Docker containers. Once it has access to the docker daemon, you can use Gorsair to directly execute commands on remote containers. Exposing the docker API on the internet is a tremendous risk,...
Banning Surveillance-Based Advertising
The Norwegian Consumer Council just published a fantastic new report: "Time to Ban Surveillance-Based Advertising." From the Introduction: The challenges caused and entrenched by surveillance-based advertising include, but are not limited to: privacy and data protection infringements opaque...
DroidMorph Shows Popular Android Antivirus Fail to Detect Cloned Malicious Apps
A new research published by a group of academics has found that anti-virus programs for Android continue to remain vulnerable against different permutations of malware, in what could pose a serious risk as malicious actors evolve their toolsets to better evade analysis. "Malware writers use...
Huawei Data Communication: Disabling Insecure Algorithms on the SSH Server/Client
Checks the algorithm configuration. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...
CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
DEBIAN-CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
UBUNTU-CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
CVE-2021-28213
Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks...
CVE-2021-28213
CVE-2021-28213 concerns an EDK2 encrypted private key in IpSecDxe.efi. However, the provided connected documents do not include concrete technical details (affected products, versions, root cause, or fixes). Monitor for updates.
CVE-2021-33190
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...
Default credentials
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...
CVE-2021-33190 Bypass network access control
In Apache APISIX Dashboard version 2.6, we changed the default value of listen host to 0.0.0.0 in order to facilitate users to configure external network access. In the IP allowed list restriction, a risky function was used for the IP acquisition, which made it possible to bypass the network limi...
PT-2021-14158
Name of the Vulnerable Software and Affected Versions: Sharp NEC Displays versions UN462A R1.300 and prior to it Sharp NEC Displays versions UN462VA R1.300 and prior to it Sharp NEC Displays versions UN492S R1.300 and prior to it Sharp NEC Displays versions UN492VS R1.300 and prior to it Sharp NE...