3988 matches found
Exploit for Missing Authentication for Critical Function in Webcraftic Woody_Ad_Snippets
CVE-2019-15858 Unauthenticated Remote Code Execution at Wood...
Exploit for Missing Authentication for Critical Function in Webcraftic Woody_Ad_Snippets
CVE-2019-15858 Unauthenticated Remote Code Execution at Wood...
Firefox reveals sponsored ad “suggestions” in search and address bar
Mozilla is trying a novel experiment into striking a balance between ad revenue generation and privacy protection by implementing a new way to deliver ads in its Firefox web browser—presenting them as “suggestions” whenever users type into the dual-use search and URL address bar. The advertising...
Samba < 4.14.8 DoS Vulnerability
Samba is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...
Jenkins Enterprise and Operations Center < 2.249.32.0.2 / 2.277.41.0.2 / 2.303.1.6 Multiple Vulnerabilities (CloudBees Security Advisory 2021-08-31)
The version of Jenkins Enterprise or Jenkins Operations Center running on the remote web server is 2.x prior to 2.303.1.6, 2.249.x prior to 2.249.32.0.2, or 2.277.x prior to 2.277.41.0.2. It is, therefore, affected by multiple vulnerabilities, including the following: - Jenkins Code Coverage API...
Ecoa Bas controller 安全漏洞
ECOA BAS controller is a building automation controller. ECOA BAS controller handles HTTP GET requests and is vulnerable to information disclosure, which can be exploited by remote attackers to submit ad hoc requests that can obtain sensitive information...
SolarWinds Attackers Hit Active Directory Servers with FoggyWeb Backdoor
The threat actors behind the notorious SolarWinds supply-chain attacks have dispatched new malware to steal data and maintain persistence on victims’ networks, researchers have found. Researchers from the Microsoft Threat Intelligence Center MSTIC have observed the APT it calls Nobelium using a...
FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor
Microsoft continues to work with partners and customers to track and expand our knowledge of the threat actor we refer to as NOBELIUM, the actor behind the SUNBURST backdoor, TEARDROP malware, and related components. As we stated before, we suspect that NOBELIUM can draw from significant...
Even the CIA and NSA Use Ad Blockers to Stay Safe Online
Plus: The ransomware scourge continues, a massive botnet gets wounded, and more of the week’s top security news...
Reddit: Email Verification Bypass And Get access to user's private invitation.
Part 2 of my previous report : https://hackerone.com/reports/1225499 I am sending this report again because you closed my previous report. i posed new impact of this vulnerability in my previous report but i didn't get any reply. So i reported it again. First Vulnerability : Email verification...
Samba 4.0.0 Bypass Restriction Vulnerability (CVE-2013-0172)
Samba 4.0.0 as an AD DC may provide authenticated users with write access to LDAP directory objects. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
PetitPotam – NTLM Relay to AD CS
Deployment of an Active Directory Certificate Services AD CS on a corporate environment could allow system administrators to utilize it for establishing trust between different… Continue reading - PetitPotam - NTLM Relay to AD CS...
PT-2021-6858
Name of the Vulnerable Software and Affected Versions FortiOS versions 6.4.6 and below Description The issue is related to an improper validation of certificate with host mismatch, which may allow the connection to a malicious LDAP server via options in the GUI. This could lead to the disclosure ...
CentOS 8 : sssd (CESA-2021:3151)
The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:3151 advisory. - sssd: shell command injection in sssctl CVE-2021-3621 Note that Nessus has not tested for this issue but has instead relied only on the application's...
Security Bulletin: IBM Security Identity Manager Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20483, CVE-2021-20488)
Summary IBM has announced a release for IBM Security Identity Manager Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern server side request forgery and account take over. Vulnerability Details CVEID: CVE-2021-20483 DESCRIPTION...
PT-2021-10415
Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /ad js.php API endpoint. Recommendations: For BlueCMS version 1.6, update to a version that contains a fix for...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
CVE-2021-21679
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
Cross site request forgery (csrf)
Jenkins Azure AD Plugin 179.vf6841393099e and earlier allows attackers to craft URLs that would bypass the CSRF protection of any target URL in Jenkins...
