CVE-2020-2500

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

CVE-2020-2500

The CVE-2020-2500 entry concerns QNAP Helpdesk (Kayako service). The vulnerability is an improper access control flaw that allows an attacker to access sensitive data on the QNAP Kayako server by abusing API keys, potentially enabling control over the Helpdesk component. The underlying issue is a...

PT-2020-15882

Name of the Vulnerable Software and Affected Versions Helpdesk versions prior to 3.0.1 Description This issue allows attackers to gain control of the QNAP Kayako service due to improper access control in Helpdesk. Attackers can access sensitive data on the QNAP Kayako server using API keys...

CVE-2020-2500: Improper Access Control

This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7014

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

CVE-2020-7014

CVE-2020-7014 describes a privilege-escalation flaw in Elasticsearch where an attacker who can create an API key and also obtain an authentication token can escalate privileges by generating a token with elevated rights. Affected Elasticsearch versions span 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1, with...

PT-2020-19339 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions 6.7.0 through 6.8.7 Elasticsearch versions 7.0.0 through 7.6.1 Description: The issue concerns a privilege escalation flaw. If an attacker can create API keys and authentication tokens, they can perform a series of step...

CVE-2020-7014: Incorrect Privilege Assignment

The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys and also authentication tokens. An attacker who is able to generate an API key and an authentication...

Project iKy v2.6.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Installation Clone repository git clone https://gitlab.com/kennbroorg/iKy.git Install Backend Redis You must install Redis wget...

FinalRecon - The Last Web Recon Tool You'll Need

FinalRecon is a fast and simple python script for web reconnaissance. It follows a modular structure so in future new modules can be added with ease. Featured NullByte https://null-byte.wonderhowto.com/how-to/conduct-recon-web-target-with-python-tools-0198114/...

CVE-2016-11058

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...

Hardcoded credentials

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...

CVE-2016-11058

The CVE-2016-11058 entry concerns the NETGEAR genie Android app prior to version 2.4.34, which mishandles hard-coded API keys and session IDs. This could enable unauthorized access or session hijacking due to exposed credentials, as reflected by the CVSS scores (2.0/3.1) indicating network-exposu...

CVE-2016-11058

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...

CVE-2016-11058: Insufficient Session Expiration

The NETGEAR genie application before 2.4.34 for Android is affected by mishandling of hard-coded API keys and session IDs...

PT-2020-7987

Name of the Vulnerable Software and Affected Versions: NETGEAR genie application version prior to 2.4.34 for Android Description: The issue concerns the mishandling of hard-coded API keys and session IDs. Recommendations: For versions prior to 2.4.34, update to version 2.4.34 or later to resolve...

Project iKy v2.5.0 - Tool That Collects Information From An Email And Shows Results In A Nice Visual Interface

Project iKy is a tool that collects information from an email and shows results in a nice visual interface. Visit the Gitlab Page of the Project Installation Clone repository git clone https://gitlab.com/kennbroorg/iKy.git Install Backend Redis You must install Redis wget...

Shopify: CircleCI token in github repo allows for access to sensitive build information

While looking through some Shopify Github repos I came across the following CircleCI token: ca84774a88598f639b174d498c219163e04adbb2 in the js-buy-sdk repo. curl https://circleci.com/api/v1.1/me?circle-token=ca84774a88598f639b174d498c219163e04adbb2 returns information about the user which confirm...