3168 matches found
CVE-2020-25240
A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.0. Unpriviledged users can access services when guessing the url. An attacker could impact availability, integrity and gain information from logs and templates of the service...
CVE-2021-3167
In Cloudera Data Engineering CDE 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs...
Authentication flaw
In Cloudera Data Engineering CDE 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs...
SYS.2.3.A17
Die Nutzung von Systemaufrufen SOLLTE insbesondere fuer exponierte Dienste und Anwendungen auf die unbedingt notwendige Anzahl beschraenkt werden z. B. durch seccomp. Die vorhandenen Standardprofile bzw. -regeln von SELinux, AppArmor sowie alternativen Erweiterungen SOLLTEN manuell ueberprueft un...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to gain unauthorized access to protected information.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected information through a specially created HTML...
SYS.1.3.A16
Die Nutzung von Systemaufrufen SOLLTE insbesondere fuer exponierte Dienste und Anwendungen auf die unbedingt notwendige Anzahl beschraenkt werden. Die Standardprofile bzw. -regeln von z. B. SELinux, AppArmor SOLLTEN manuell ueberprueft und unter Umstaenden an die eigenen Sicherheitsrichtlinien...
Lenovo XClarity Orchestrator 安全漏洞
Lenovo XClarity Orchestrator is an application from the Chinese company Lenovo. It provides centralized monitoring, management, and analysis for environments containing a large number of devices. A security vulnerability exists in LXCO prior to version 1.2.2, which stems from the fact that if the...
Mazafaka — Elite Hacking and Cybercrime Forum — Got Hacked!
In what's a case of hackers getting hacked, a prominent underground online criminal forum by the name of Maza has been compromised by unknown attackers, making it the fourth forum to have been breached since the start of the year. The intrusion is said to have occurred on March 3, with informatio...
DEBIAN-CVE-2021-23961
Further techniques that built on the slipstream research combined with a malicious webpage could have exposed both an internal network's hosts as well as services running on the user's local machine. This vulnerability affects Firefox 85...
ansible: multiple modules expose secured values
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by nolog feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to dat...
Beware: New Matryosh DDoS Botnet Targeting Android-Based Devices
A nascent malware campaign has been spotted co-opting Android devices into a botnet with the primary purpose of carrying out distributed denial-of-service DDoS attacks. Called "Matryosh" by Qihoo 360's Netlab researchers, the latest threat has been found reusing the Mirai botnet framework and...
The vulnerability of the _exposedProps_ mechanism in the Mozilla Firefox browser allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the exposedProps mechanism in Mozilla Firefox is related to the lack of access restrictions for certain exposed properties. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
Cross-site Request Forgery (CSRF)
Overview fastify-csrf is an A plugin for adding CSRF protection to Fastify. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true . Also, the CS...
USN-4699-1 log4net vulnerability
It was discovered that Apache Log4net incorrectly handled certain configuration files. An attacker could possibly use this issue to expose sensitive information...
Kartpay: Misconfiguration of Merchant id in jwt header + Weird Debug mode enabling behavior leads to exposed OTP of mobile number.
The Verification email Content was able to decrypt easily and leads to disclosure of information that was supposed to be provided after account verification is completed. Secondly, For a Limited time Production was put on debug mode but it was left with it. so now it has been fixed...
CVE-2021-3032
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of...
CVE-2021-3032
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “snmptrap” v3 log forwarding server profiles can be logged to the logrcvr.log system log. Logged information may include up to 1024 bytes of...
IBM Security Guardium Insights 安全漏洞
IBM Security Guardium Insights is a modern hybrid cloud data security hub designed to provide a reliable view of an organization's data security and compliance posture. An information disclosure vulnerability exists in IBM Security Guardium Insights 2.0.2. The vulnerability stems from the product...
Usenet indexer NZBGeek hacked; database stolen
By Deeba Ahmed Hackers installed keylogger and copied NZBGeek database exposing personal details of all users. This is a post from HackRead.com Read the original post: Usenet indexer NZBGeek hacked; database stolen...
GRecon - Your Google Recon Is Now Automated
GRecon Greei-Conn is a simple python tool that automates the process of Google Based Recon AKA Google Dorking The current Version 1.0 Run 7 Search Queries 7 Micro-Plugins on the spicified Target Providing Awsome Results Current Version Run Google Search Queries to find : Subdomains Sub-Subdomains...