PT-2021-18628 · Friendica · Friendica

Name of the Vulnerable Software and Affected Versions: Friendica versions through 2021.01 Description: The issue allows the settings/userexport feature to be accessed by anonymous users, potentially leading to excessive memory consumption and attempted access to an array offset on a value of type...

CVE-2021-22200

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user...

GitLab 安全漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab CE/EE affecting a...

PT-2021-14911 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.6 and later Description: An issue has been discovered affecting GitLab CE/EE, where under a special condition, it was possible for an anonymous user to access data of an internal repository through a public project...

CVE-2021-26071

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery CS...

CVE-2020-36238

The /rest/api/1.0/render resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to determine if a username is valid or not via a missing permissions check...

CVE-2021-26071

The SetFeatureEnabled.jspa resource in Jira Server and Data Center before version 8.5.13, from version 8.6.0 before version 8.13.5, and from version 8.14.0 before version 8.15.1 allows remote anonymous attackers to enable and disable Jira Software configuration via a cross-site request forgery CS...

PT-2021-11975 · Atlassian · Jira

Name of the Vulnerable Software and Affected Versions: Jira Server and Data Center versions 8.5.12 and earlier Jira Server and Data Center versions 8.6.0 through 8.13.4 Jira Server and Data Center versions 8.14.0 through 8.15.0 Description: The issue allows remote anonymous attackers to determine...

GenericSetup 信息泄露漏洞

GenericSetup is an open source mini-framework for representing the configuration state of a Zope Site as a set of file system artifacts. An information disclosure vulnerability exists in versions of GenericSetup prior to 2.1.1 that stems from allowing an anonymous visitor to potentially view log...

Shopify: Is the Google Bucket Meant To Be Publicly Listable? https://cdn.shopify.com/shop-assets/

Hi, I found that https://cdn.shopify.com/shop-assets/ is listing the all objects in https://storage.googleapis.com/arrive-assets-storage-production/ But when I directly visit https://storage.googleapis.com/arrive-assets-storage-production/, it says Anonymous caller does not have...

DEBIAN-CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

Design/Logic Flaw

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

UBUNTU-CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

PT-2021-16958

Name of the Vulnerable Software and Affected Versions Apache ActiveMQ Artemis versions prior to 2.16.0 Apache ActiveMQ versions prior to 5.16.1 Apache ActiveMQ versions prior to 5.15.14 Description The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP serve...

CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error...

CVE-2021-26117

CVE-2021-26117 describes an LDAP authentication weakness in the optional ActiveMQ LDAP login module where anonymous access can bypass password verification. Connected sources confirm affected lines: Apache ActiveMQ Artemis prior to 2.16.0 and Apache ActiveMQ prior to 5.16.1 and 5.15.14. Debian/Ub...

Unauthorized Access Vulnerability in Tianrongxin TAP Series Smart Wireless AP Devices

Ltd. As a leading company in China's information security industry, TIANRONGXIN was founded in 1995 and is headquartered in Beijing. An unauthorized access vulnerability exists in TIANRONGXIN TAP series Smart Wireless AP devices, which can be exploited by an attacker to anonymously connect to the...

Unauthorized Access Vulnerability in Alcatel OAW Series Smart Wireless AP Devices

Alcatel-Lucent, a multinational company providing telecommunications hardware and software equipment and services, is headquartered in Paris, France. An unauthorized access vulnerability exists in the Alcatel OAW series of Smart Wireless AP devices, which can be exploited by an attacker to...

CVE-2020-15775

An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously...

Information disclosure

An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names and build counts over time. This page is incorrectly viewable anonymously...