Epikur 访问控制错误漏洞

Epikur is a healthcare mobile application from German company Epikur that provides users with psychotherapy, patient management and other features. An authorization issue vulnerability exists in Epikur versions prior to 20.1.1 that stems from an administrator account accessing the default...

JetBrains Ktor framework 加密问题漏洞

JetBrains Ktor is a web application framework from the Czech company JetBrains. A default configuration issue vulnerability exists in versions of JetBrains Ktor prior to 1.4.2, which stems from the fact that the weak password suite is enabled by default. No details of the vulnerability are provid...

keycloak: Default Client configuration is vulnerable to SSRF using "request_uri" parameter

A flaw was found in Keycloak, where it is possible to force the server to call out an unverified URL using the OIDC parameter requesturi. This flaw allows an attacker to use this parameter to execute a Server-side request forgery SSRF attack...

CVE-2021-3156: Heap-Based Buffer Overflow in Sudo (Baron Samedit)

Update Feb 3, 2021: It has been reported that macOS, AIX, and Solaris are also vulnerable to CVE-2021-3156, and that others may also still be vulnerable. Qualys has not independently verified the exploit. Original Post: The Qualys Research Team has discovered a heap overflow vulnerability in sudo...

MISP Default Configuration Error Vulnerability

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A default configuration error vulnerability exists in MISP version 2.4.136, which stems fr...

MISP 授权问题漏洞

MISP is an open source software solution. The product is used to collect, store, distribute and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A default configuration error vulnerability exists in MISP version 2.4.136, which stems fr...

Default configuration

The default configuration of Crimson 3.1 Build versions prior to 3119.001 allows a user to be able to read and modify the database without authentication...

Crimson Critical Function Missing Authentication Vulnerability

Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...

Red Lion Controls Crimson 访问控制错误漏洞

Crimson is a programming software from Red Lion. Crimson suffers from a lack of authentication vulnerability in critical functions. An attacker could exploit this vulnerability to read and modify databases without authentication in the default configuration...

Dell Wyse ThinOS 安全漏洞

Wyse ThinOS is a highly secure, virus-resistant thin operating system. An insecure default configuration vulnerability exists in Wyse ThinOS 8.6 and earlier versions. An attacker could exploit the vulnerability to access sensitive information on the local network...

Certain NETGEAR devices Default Configuration Issue Vulnerability

NETGEAR Route Serices are a series of wireless routers from NETGEAR. Certain NETGEAR devices are vulnerable to a default configuration issue and the following products and versions are affected: AC2100 before 1.2.0.72, AC2400 before 1.2.0.72, AC2600 before 1.2.0.72, CBK40 before 2.5.0.10, CBR40...

D-Link DSL-2888A Default Configuration Issue Vulnerability

The D-link DSL-2888A is a Unified Services Router from D-link China. A default configuration issue vulnerability exists in the D-Link DSL-2888A devices, which can be exploited by an attacker to access system folders and download sensitive files e.g., password hash files...

D-link DSL-2888A 默认配置问题漏洞

The D-link DSL-2888A is a Unified Services Router from D-link China. A default configuration issue vulnerability exists in the D-Link DSL-2888A devices, which can be exploited by an attacker to access system folders and download sensitive files e.g., password hash files...

Default configuration

In certain scenarios in Tenable.sc prior to 5.17.0, a scanner could potentially be used outside the user's defined scan zone without a particular zone being specified within the Automatic Distribution configuration...

PYSEC-2020-22

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have...

PT-2020-6687 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 1.10.14 Description: The issue is related to incorrect session validation in the Apache Airflow web server, caused by the use of a default configuration that includes a pre-set secret key. This allows a...

CVE-2020-13535

A privilege escalation vulnerability exists in Kepware LinkMaster 3.0.94.0. In its default configuration, an attacker can globally overwrite service configuration to execute arbitrary code with NT SYSTEM privileges...

Multiple Samsung Products Default Configuration Issue Vulnerability

Samsung mobile devices O are products of Samsung Corporation in South Korea.Samsung mobile devices O is a series of cell phones.Samsung mobile devices P is a series of mobile hard drives.Samsung mobile devices Q is a series of TVs.Samsung mobile devices Q is a series of TVs. Samsung mobile device...

php: Integer wraparounds when receiving multipart forms

A flaw was found in PHP under a non-default configuration, where it was vulnerable to integer wraparounds during the reception of a multipart POST request. This flaw allows a remote attacker to repeatedly crash PHP and fill the filesystem with temporary PHP files, resulting in a denial of service...

Default configuration

The default installation path of the TwinCAT XAR 3.1 software in all versions is underneath C:\TwinCAT. If the directory does not exist it and further subdirectories are created with permissions which allow every local user to modify the content. The default installation registers TcSysUI.exe for...