4023 matches found
USN-5454-1 cups vulnerabilities
Joshua Mason discovered that CUPS incorrectly handled the secret key used to access the administrative web interface. A remote attacker could possibly use this issue to open a session as an administrator and execute arbitrary code. CVE-2022-26691 It was discovered that CUPS incorrectly handled...
CVE-2021-28509
This advisory documents the impact of an internally found vulnerability in Arista EOS state streaming telemetry agent TerminAttr and OpenConfig transport protocols. The impact of this vulnerability is that, in certain conditions, TerminAttr might leak MACsec sensitive data in clear text in CVP to...
CVE-2021-28509
CVE-2021-28509 : Arista EOS TerminAttr and OpenConfig transport can leak MACsec data in clear text to authorized users, enabling potential decryption/modification of MACsec traffic. Affected: EOS devices with Octa and TerminAttr enabled; specific affected versions include EOS 4.23.x–4.27.x trains...
142 Million MGM Resorts Records Leaked on Telegram for Free Download
By Waqas As seen by Hackread.com and researchers at VPNMentor, the leaked data includes sensitive PII information of MGM resort… This is a post from HackRead.com Read the original post: 142 Million MGM Resorts Records Leaked on Telegram for Free Download...
Google Chrome 资源管理错误漏洞
Google Chrome is a web browser from Google, Inc. Google Chrome suffers from a resource management error vulnerability that originates from a post-release reuse issue in the browser's App Service. A remote attacker could trick a victim into visiting a specially crafted web page to gain access to...
CVE-2022-28998
Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted code...
CVE-2021-21209
Inappropriate implementation in storage in Google Chrome prior to 90.0.4430.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page...
CVE-2022-30618
An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users from:users-permissions. There are many scenarios in whic...
CVE-2022-30618
The CVE-2022-30618 entry describes a vulnerability in Strapi where an authenticated user with access to the Strapi admin panel can view private data (e.g., email, password reset tokens) of API users when content types have relationships to API users (from: users-permissions). The leak occurs in J...
CVE-2022-30617
The CVE-2022-30617 issue affects Strapi where an authenticated admin-panel user can read private data (e.g., emails, password reset tokens) for other admin users via related content in the JSON response. This leakage occurs across relationships (e.g., content created/updated by another user) and ...
Russian Conti Ransomware Gang Threatens to Overthrow New Costa Rican Government
The notorious Conti ransomware gang, which last month staged an attack on Costa Rican administrative systems, has threatened to "overthrow" the new government of the country. "We are determined to overthrow the government by means of a cyber attack, we have already shown you all the strength and...
CVE-2021-35249
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data read only operation. This UAC issue leads to a data leak to...
Improper access control
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data read only operation. This UAC issue leads to a data leak to...
CVE-2021-35249
CVE-2021-35249 concerns SolarWinds Serv-U FTP Server. Connected sources confirm a broken access control vulnerability in Serv-U versions prior to 15.3.1 where a domain admin can read configuration and user data across other domains they should not access. The issue is read-only from the attacker’...
CVE-2021-35249 Domain Admin Broken Access Control
This broken access control vulnerability pertains specifically to a domain admin who can access configuration & user data of other domains which they should not have access to. Please note the admin is unable to modify the data read only operation. This UAC issue leads to a data leak to...
OpenStack Nova host data leak to vm instance in rescue mode
The instance rescue mode in OpenStack Compute Nova 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image...
GHSA-W429-XC55-HC48 OpenStack Nova host data leak to vm instance in rescue mode
The instance rescue mode in OpenStack Compute Nova 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image...
py-cinder -- data leak
Duncan Thomas reports: The 1 GlusterFS and 2 Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header...
PT-2022-10452 · Solarwinds · Serv-U
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: This issue pertains to a broken access control vulnerability where a domain admin can access configuration and user data of other domains without authorization. The access is...