844 matches found
tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...
openSUSE Security Update : java-11-openjdk (openSUSE-2019-161)
This update for java-11-openjdk to version 11.0.2+7 fixes the following issues : Security issues fixed : - CVE-2019-2422: Better FileChannel transfer performance bsc1122293 - CVE-2019-2426: Improve web server connections - CVE-2018-11212: Improve JPEG processing bsc1122299 - Better route routing ...
Security update for java-11-openjdk (important)
openSUSE Security Update: Security update for java-11-openjdk Announcement ID: openSUSE-SU-2019:0161-1 Rating: important References: 1120431 1122293 1122299 Cross-References: CVE-2018-11212 CVE-2019-2422 CVE-2019-2426 Affected Products: openSUSE Leap 15.0 An update that fixes three vulnerabilitie...
GHSA-PJXW-22XF-6PWC Prototype Pollution in defaults-deep
All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our...
3gtel-frontend-platform (1.0.0), @achieve-all/v-element (1.0.0) +404 more potentially affected by CVE-2018-16486 via defaults-deep (>=0.2.3, <=0.2.4)
defaults-deep NPM version =0.2.3, =0.1.1, =1.0.0, =1.0.0, =2.0.0, =2.0.7, =0.1.0, =1.0.0, =1.0.8, =0.1.2, =1.0.3, =1.0.0, =6.0.0-rc1, =7.4.3 and more Source cves: CVE-2018-16486 Source advisory: OSV:GHSA-PJXW-22XF-6PWC...
Prototype Pollution in defaults-deep
All versions of defaults-deep are vulnerable to prototype pollution. Provided certain input defaults-deep can add or modify properties of the Object prototype. These properties will be present on all objects. Recommendation As no patch is currently available for this vulnerability it is our...
Buffer overflow
A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...
CVE-2018-16486
A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...
CVE-2018-16486
A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...
CVE-2018-16486
A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...
CVE-2018-16486
Summary: CVE-2018-16486 corresponds to a prototype pollution vulnerability in the npm package defaults-deep, affecting versions ⤠0.2.4. The vulnerability allows an attacker to inject or modify properties on Object.prototype, which can affect all objects in the runtime. Several sources (OSV, GHSA...
PT-2019-9310
Name of the Vulnerable Software and Affected Versions defaults-deep versions prior to a fixed version no fixed version specified defaults-deep all versions Description A prototype pollution issue allows a malicious user to inject properties onto Object.prototype, given certain input. This can add...
CVE-2018-16486: Uncontrolled Resource Consumption
A prototype pollution vulnerability was found in defaults-deep =0.2.4 that would allow a malicious user to inject properties onto Object.prototype...
Insecure Defaults
Apache Tomcat is vulnerable to insecure defaults. The CORS filter provided by default is insecure as it enables supportsCredentials for all origins. This can allow a malicious user unauthorized access to sensitive resources...
Insecure Defaults
cfme is vulnerable to insecure defaults. The vulnerability exists as the customization template in Red Hat CloudForms 3.1 Management Engine CFME 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges...
Insecure Defaults
openshift-origin-broker is vulnerable to insecure defaults. The vulnerability exists as it was discovered that openshift-origin-broker configured several default user names and passwords for services if no user name or password was specified during installation. A remote attacker could use these...
November 13, 2018âKB4467708 (OS Build 17763.134)
None None...
The vulnerability of the computerdefaults component of the Windows operating system, related to access control errors, allows a perpetrator to escalate their privileges through bypassing the UAC mechanism.
The vulnerability of the computer Defaults.exe component of the Windows operating system is related to access control errors. Exploiting this vulnerability could allow an attacker to enhance their privileges by bypassing the UAC mechanism through manipulation of the registry...
GHSA-R4X2-3CQ5-HQVP The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their...
CVE-2018-15386
A vulnerability in Cisco Digital Network Architecture DNA Center could allow an unauthenticated, remote attacker to bypass authentication and have direct unauthorized access to critical management functions. The vulnerability is due to an insecure default configuration of the affected system. An...