3168 matches found
Cloud firewall management API SNAFU put 500k SonicWall customers at risk
TL;DR I found an IDOR in SonicWalls cloud management platform API Any user could add themselves to any account at any organisation using it Anyone could create a user account to exploit the issue, from the public internet Can be used to change firewall rules, or add rogue VPN users, for example...
Acronis: mysql credentials exposed on - https://cz.acronis.com/docker-compose.yml
Hi, there are some MySQL credentials exposed on https://cz.acronis.com/docker-compose.yml It is not that you are gonna avoid a compromise with that user/password pair, but just in case you don't wanna make it even easier publishing the credentials to the wild x Impact MySQL credentials exposed...
CVE-2019-20150
In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's...
Solana BBP: i don't the important and it's impact . the affected asset : https://github.com/solana-labs/solana/blob/master/.buildkite/env/secrets.ejson
Summary: add summary of the vulnerability Steps To Reproduce: add details for how we can reproduce the issue 1. i have browsed this source code of github: https://github.com/solana-labs/solana/tree/master/programs 1. i have browsed the files and i found the file which called...
Joomla! 2.5.x < 3.9.20 Multiple Vulnerabilities
According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.20. It is, therefore, affected by multiple vulnerabilities. - A missing token check in the ajaxinstall endpoint cominstaller causes a CSRF vulnerability. - Missing validation...
350 million email addresses exposed on misconfigured AWS S3 bucket
By Sudais Asif It is still unclear who owned the misconfigured Amazon S3 bucket. This is a post from HackRead.com Read the original post: 350 million email addresses exposed on misconfigured AWS S3 bucket...
Lindy 42633 Elevation of Privilege Vulnerability
The Lindy 42633 is a 4-port USB 2.0 Gigabit network server. An elevation of privilege vulnerability exists in the Lindy 42633 2.078.000. The vulnerability stems from the ability to discover the administrative password by sniffing unencrypted UDP traffic. An attacker on the same network could use...
PT-2020-13262 · Comodo +1 · Combodo Itop +1
Name of the Vulnerable Software and Affected Versions: Combodo iTop affected versions not specified Description: A security misconfiguration exists in Combodo iTop, which can expose sensitive information. Recommendations: At the moment, there is no information about a newer version that contains ...
CVE-2020-15058
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic...
Undetectable Linux Malware Targeting Docker Servers With Exposed APIs
Cybersecurity researchers today uncovered a completely undetectable Linux malware that exploits undocumented techniques to stay under the radar and targets publicly accessible Docker servers hosted with popular cloud platforms, including AWS, Azure, and Alibaba Cloud. Docker is a popular...
CVE-2020-12880
An issue was discovered in Pulse Policy Secure PPS and Pulse Connect Secure PCS Virtual Appliance before 9.1R8. By manipulating a certain kernel boot parameter, it can be tricked into dropping into a root shell in a pre-install phase where the entire source code of the appliance is available and...
Liferay Portal <= 7.1.3, 7.2.x <= 7.2.1 Multiple Vulnerabilities
Liferay Portal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:liferay:liferayportal"; if...
Design/Logic Flaw
An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. There exists an exposed administration function in getcfg.php, which can be used to call various services. It can be utilized by an attacker to retrieve various sensitive information, such as admin login credentials, by...
Who Pulled Off the Twitter Hack?
Plus: WhatsApp’s court case, a VPN exposed, and more of the week’s top security news...
CVE-2020-14501
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function CWE-306 issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also...
CVE-2019-20898
creationtimestamp| type| source ---|---|--- 2020-07-13 07:55:01+00:00| seen| https://t.me/cibsecurity/13418...
Pingxiang Ganxi Network Technology Co., Ltd. website building system has SQL injection vulnerability
Ltd. is a company engaged in website construction. There is a SQL injection vulnerability in the website building system of Pingxiang Ganxi Network Technology Co. Ltd, which can be exploited by attackers to obtain sensitive information from the database...
O2 Business for Android Input Validation Error Vulnerability
O2 Business for Android is an Android-based application for connecting O2 Business solutions from O2 UK. A security vulnerability exists in version 1.2.0 of O2 Business for Android-based platforms, which stems from the program exposing the canvasm.myo2.SplashActivity activity to other application...
CVE-2019-4706
IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. IBM X-Force ID: 172016...