Magento API Anonymous Access

Sensitive Magento 2 API can be accessed by anonymous users. Therefore, confidential merchant information can be exposed like offline products, stock information or store configuration for example. No source data...

subversion: NULL pointer dereference in svnserve leading to an unauthenticated remote DoS

A flaw was found in subversion. A remote, unauthenticated user can cause a null-pointer-dereference in svnserve by sending a certain sequences of protocol commands to the server. This results in a denial of service in some server configurations, specifically when anonymous access is enabled. The...

VulnCheck KEV: CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance is accessible by anonymous users and can be abused to perform remote code execution...

Using SMB to bypass PHP Remote File Inclusion limit-vulnerability warning-the black bar safety net

In this article, I share a little bit of PHP Program in a remote file inclusion vulnerability, it will often be in the file contains is use. Although the PHP environment has been configured to prohibit from the remote HTTP/FTP URL contains the file, but I will share how to bypass Remote File...

DRUPAL-CONTRIB-2019-004

The Preview Link module enables you to generate preview links so anonymous users can access unpublished revisions of content. The last release of the module introduced an access bypass allowing users to present invalid tokens but still access unpublished content...

PT-2019-4310

Name of the Vulnerable Software and Affected Versions Kubernetes API server versions v1.0 through v1.12 Kubernetes API server versions prior to v1.13.12 Kubernetes API server versions prior to v1.14.8 Kubernetes API server versions prior to v1.15.5 Kubernetes API server versions prior to v1.16.2...

Information Disclosure

atomic-openshift is vulnerable to information disclosure. An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a...

Dropbox: Disclose anonymous accessible link on embedded files in paper dropbox sessions

This report described some of the behavior of the integration between Dropbox and Dropbox Paper. In particular, when embedding a Dropbox file into Dropbox Paper, this implicitly creates a link to that file see https://www.dropbox.com/help/files-folders/view-only-access and embeds it within the...

CVE-2018-16959

An issue was discovered in Oracle WebCenter Interaction Portal 10.3.3. The portal component is delivered with an insecure default User Profile community configuration that allows anonymous users to retrieve the account names of all portal users via /portal/server.pt/user/user/ requests. When WCI ...

Uber: [experience.uber.com] Node.js source code disclosure & anonymous access to internal Uber documents, templates and tools

A configuration file on experience.uber.com exposed details for the server configuration as well as information about the content hosted on the site. The site itself did require authentication to log in, but this config file was publicly accessible. Other accessible URLs included slide deck...

Design/Logic Flaw

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

CVE-2017-3209

The CVE-2017-3209 entry concerns the DBPOWER U818A WIFI quadcopter drone, which runs an FTP server on its local AP that by default allows anonymous access with full filesystem permissions. The anonymous user can read arbitrary files (e.g., images/videos) and even replace system files such as /etc...

CVE-2017-3209: Incorrect Default Permissions

The DBPOWER U818A WIFI quadcopter drone provides FTP access over its own local access point, and allows full file permissions to the anonymous user. The DBPower U818A WIFI quadcopter drone runs an FTP server that by default allows anonymous access without a password, and provides full filesystem...

Microsoft Windows: Network access: Named Pipes that can be accessed anonymously

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnapipesaccessedanonym.nasl 11532 2018-09-21 19:07:30Z cfischer $ Check value for Network access: Named Pipes that can be accessed anonymously Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

VPNFilter Malware Impact Larger Than Previously Thought

Researchers say the impact of the VPNFilter malware discovered last month is larger than originally reported. On Wednesday, Cisco Talos researchers said they now believe the malware has infected twice the number of router brands than previously stated. They added that VPNFilter also delivers a mo...

CVE-2018-11138

The '/common/downloadagentinstaller.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system...

PT-2018-10329

Name of the Vulnerable Software and Affected Versions Quest KACE System Management Appliance version 8.0.318 Description The issue concerns the accessibility of the "/common/download agent installer.php" script by anonymous users, which can be exploited to execute arbitrary commands on the system...

CVE-2018-10682

An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment permits an...

PT-2018-10050 · Red Hat · Wildfly

Name of the Vulnerable Software and Affected Versions: WildFly version 10.1.2.Final Description: An issue allows an attacker to access the administration panel without authentication using anonymous access. Once logged in, a misconfiguration permits an anonymous user to deploy a malicious .war...

Onvif protocol anonymous access vulnerability in yestv cameras

Yestv yestv camera is wireless network wifi smart monitor. Yestv cameras have an anonymous access vulnerability in the onvif protocol. The vulnerability is due to call onvif protocol interface to arbitrarily modify the network configuration, arbitrary reboot device, the attacker can write a messa...