706 matches found
Learn How Hackers Can Hijack Your Online Accounts Even Before You Create Them
Malicious actors can gain unauthorized access to users' online accounts via a new technique called "account pre-hijacking," latest research has found. The attack takes aim at the account creation process that's ubiquitous in websites and other online platforms, enabling an adversary to perform a...
Zoho ManageEngine Remote Access Plus 安全漏洞
Zoho ManageEngine Remote Access Plus is a remote access solution from ZOHO, Inc. A security vulnerability exists in Zoho ManageEngine Remote Access Plus, which could be exploited by an attacker to allow guest users to view domain details such as the administrator's username and GUID...
PT-2022-15288 · Juniper Networks · Juniper Networks Paragon Active Assurance
Name of the Vulnerable Software and Affected Versions: Juniper Networks Paragon Active Assurance version 3.1.0 Description: An issue in the Juniper Networks Paragon Active Assurance Control Center allows an unauthenticated attacker to leverage a crafted URL to generate PDF reports, potentially...
CVE-2022-0675
A flaw was found in the Puppet Firewall module. In certain situations, an unmanaged rule can exist on the target system that has the same comment as a rule specified in the manifest. When this condition is true, Puppet will ignore the unmanaged rule and continue to apply the rule in the manifest...
CVE-2022-20025
creationtimestamp| type| source ---|---|--- 2022-02-10 02:19:18+00:00| seen| https://t.me/cibsecurity/37158...
CVE-2021-40418
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID that was parsed from a frame within the video container. Upon destruction of the object that owns it, the...
CVE-2021-42565
myfactory.FMS before 7.1-912 allows XSS via the UID parameter...
Code injection
ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek TUTK device given a valid 20-byte uniquely assigned identifier UID. This could result in an attacker hijacking a victim's connection and forcing them into supplying credentials needed to access the...
Roxy-WI SQL注入漏洞
Roxy-WI is a web interface for managing Haproxy, Nginx, and Keepalived servers. SQL injection vulnerabilities exist in Roxy-WI 5.2.2.0 and earlier versions, and attackers can use checklogin to extract a valid uuid to bypass authentication...
OpenStack 安全漏洞
OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration NASA in collaboration with Rackspace. A security vulnerability exists in OpenStack Keystone that stems from the product's failure to restrict users from certain malicious requests. An...
Default configuration
The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System NFS allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier UID over NFS to rewrite sensitive files to gain...
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
...
CVE-2021-3538
A flaw was found in github.com/satori/go.uuid in versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45. Due to insecure randomness in the g.rand.Read function the generated UUIDs are predictable for an attacker...
PT-2021-20903 · Go.Uuid · Go.Uuid
Name of the Vulnerable Software and Affected Versions: github.com/satori/go.uuid versions from commit 0ef6afb2f6cdd6cdaeee3885a95099c63f18fc8c to d91630c8510268e75203009fe7daf2b8e1d60c45 Description: A flaw in the github.com/satori/go.uuid package causes the generated UUIDs to be predictable for ...
go.uuid 安全特征问题漏洞
go.uuid is a UUID package for Go. This package provides a pure Go implementation of the Universally Unique Identifier UUID. UUID creation and resolution is supported. A security vulnerability exists in go.uuid, which stems from an insecure randomness in the g.rand.Read function that can be...
Authentication Bypass in hydra
Impact When using client authentication method "privatekeyjwt" 1, OpenId specification says the following about assertion jti: A unique identifier for the token, which can be used to prevent reuse of the token. These tokens MUST only be used once, unless conditions for reuse were negotiated betwe...
Emissary 跨站脚本漏洞
Emissary is a software application. A P2P-based data-driven workflow engine that runs on heterogeneous and potentially widely distributed multi-tier P2P network computing resources. A cross-site scripting vulnerability exists in Emissary version 5.9.0, which can be exploited by an attacker to...
atomic-openshift: cross-namespace owner references can trigger deletions of valid children
A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects...
CVE-2020-13186
An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed an attacker with knowledge of both a machineID and user GUID to modify data if a user clicked a malicious link...