puppet-swift: installs config file with world readable permissions

An information-disclosure flaw was discovered in Red Hat OpenStack Platform director's installation of Object Storage swift. During installation, the Puppet script responsible for deploying the service incorrectly removes and recreates the proxy-server.conf file with world-readable permissions...

Zend Framework Configuration File Disclosure Vulnerability

Zend Framework ZF is the United States Zend company developed a set of open source PHP5 development framework , it is mainly used for the development of Web programs and services. Zend Framework has a configuration file disclosure vulnerability that can be exploited by an attacker to download...

Fedora 25 : phpMyAdmin (2016-6576a8536b)

phpMyAdmin 4.6.5.1 2016-11-26 =============================== A patch-level release fixing two small issues : - an issue affecting a small number of users using $cfg'Servers'$i'hidedb' or $cfg'Servers'$i'onlydb'. - an issue affecting the create table dialog where the partition selection tool was...

LocalTapiola: Suspicious browser fingerprinting(?) scripts on http://www.lahitapiola.fi/ redirector

I was doing some routine scanning of my Internet traffic at work I work as a Security Researcher for Forcepoint and noticed that my IDS popped up alarms of a ton of suspicious behaviour when I was trying to access http://www.lahitapiola.fi/ front page. It turned out that there seems to be a lot o...

Insecure Server Configuration

An incorrect Web management server configuration was identified in PAN-OS. Ref PAN-52038/86767...

Propagation Fails with error "Failed to get the end status of the server configuration update."

"Failed to get the end status of the server configuration update." "Failure to notify of configuration update." "An erorr occurred running the command : 'Add-DSFeatureInstances'...

Ian Dunn: [Not just a server configuration issue] Full Path Disclosure

Hey, I've just found a 'full path disclosure' in basic-google-maps-placemarks, so it's not just a server configuration issue! I've tested it on different servers including windows, ubuntu, CentOS etc.. PoC So, if we visit wp-content/plugins/basic-google-maps-placemarks/unit-tests.php it is clearl...

GoCD: Reflected XSS

Possible XSS when updating server configuration...

GoCD: XSS in http://localhost:8153/go/admin/config/server/update

Possible XSS when updating server configuration...

Prometheus API Information Gather

This module utilizes Prometheus' API calls to gather information about the server's configuration, and targets. Fields which may contain credentials, or credential file names are then pulled out and printed. Targets may have a wealth of information, this module will print the following values whe...

Troubleshooting Checklist: In Secure Mail, a "Cannot authenticate to the server <FQDN> because the certificate is not valid” error appears

Do the following: Ensure that the certificate chain is valid and that the configuration is complete on the Exchange Server. Try to connect the native email client with the same Exchange Server. If it works as expected, the issue is with client certificate configuration on the XenMobile server Onl...

Cookie attribute injection attack

PMASA-2016-18 Announcement-ID: PMASA-2016-18 Date: 2016-06-23 Summary Cookie attribute injection attack Description A vulnerability was found where, under some circumstances, an attacker can inject arbitrary values in the browser cookies. Severity We consider this to be non-critical. Mitigation...

Theory PHP Common Vulnerabilities the second bomb: common contains the vulnerability-vulnerability warning-the black bar safety net

Contains generally divided into LFI, RFI, i.e., local file inclusion and remote file inclusion LFI For LFI while 因为 很 多 都 限制 了 包含 的 后缀 结尾 必须 为 .php Include $a.'. php'such as this. So we want to include our pictures of the horses while 那么 就 需要 截断 后面 的 这 .php 1. 0 0 truncated. Need gpc off &&...

[SECURITY] Fedora 24 Update: phpMyAdmin-4.6.2-1.fc24

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

Phabricator: Full path disclosure

Mongoose. The full path of the phabricator install is shown if you go to /login/mustverify/ while being logged out. This could be seen as a server configuration issue, but I think I followed your installation guide closely. Since I already wrote it I include a little patch, please feel free to...

Moxa EDR-G903 Unauthorized Operation Vulnerability

Moxa EDR-G903 is a suite of Moxa's all-in-one firewall/VPN security router products. A security vulnerability exists in the Moxa EDR-G903 V3.4.11 and earlier versions. An unauthenticated remote attacker can exploit the vulnerability by accessing a specially crafted URL to delete server-side...

Gratipay: suppress version in Server header on gratipay.com or grtp.co

Summary: Server version information is returned in the response headers. Estimated severity: Low More info: Any page requested on the site returns a lot of information in the response headers. This information includes specific version information for the server and proxy. The following version...

Web Server Error Page Information Disclosure

The default error page sent by the remote web server discloses information that can aid an attacker, such as the server version and languages used by the web server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

UBUNTU-CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues ...

Let's Encrypt Initiative Enters Public Beta

The Let’s Encrypt initiative reached yet another milestone this week when it entered public beta, something it claims should help make it easier for website owners to embrace HTTPS encryption. The latest step comes on the heels of the movement issuing its first certificate back in September and...