108 matches found
com.adobe.aem.addon.guides:aem-guides-it-tests (>=0.0.1 <=0.0.2), com.adobe.aem.guides:aem-cif-guides-venia.it.tests (>=2012.12.01 <=2024.10.07) +44 more potentially affected by CVE-2017-15717 via org.apache.sling:org.apache.sling.xss (>=1.0.4 <=2.0.12)
org.apache.sling:org.apache.sling.xss MAVEN version =1.0.4, =0.0.1, =2012.12.01, =0.0.4, =0.1.0, =0.2.6, =2.17.0, =2.18.0, =2.17.10, =0.1.0, =0.1.0, =1.0.0, =0.2.1, =0.9.2 and more Source cves: CVE-2017-15717 Source advisory: OSV:GHSA-7MFW-43C4-45MQ...
New Hub for Lean IT Security Teams
One of the harsh realities of cybersecurity today is that malicious actors and attackers don’t distinguish between organizations that have seemingly endless resources and those operating with lean IT security teams. For these lean teams, meeting the challenges in the current security landscape...
Improving security for mobile devices: CISA issues guides
The Cybersecurity and Infrastructure Security Agency CISA has released two actionable Capacity Enhancement Guides CEGs to help users and organizations improve mobile device cybersecurity. Consumers One of the guides is intended for consumers. There are an estimated 294 million smart phone users i...
CISA Releases Capacity Enhancement Guides to Enhance Mobile Device Cybersecurity for Consumers and Organizations
CISA has released actionable Capacity Enhancement Guides CEGs to help users and organizations improve mobile device cybersecurity. The CEG: Mobile Device Cybersecurity Checklist for Consumers provides steps for consumers, including using strong authentication and enabling automatic operating syst...
Authentication Bypass by CSRF Weakness
Impact CSRF vulnerability that allows user account takeover. All applications using any version of the frontend component of solidusauthdevise are affected if protectfromforgery method is both: - Executed whether as: - A beforeaction callback the default - A prependbeforeaction option prepend: tr...
rocknrollmountainguides.at Improper Access Control vulnerability OBB-2229322
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
vulhub
This is an open-source collection of vulnerable web applications and environments for testing and learning purposes. It is a community-driven project that aims to provide a safe and controlled environment for users to practice and improve their skills in web application security. The repository...
Army Testing Facial Recognition in Child-Care Centers
Live video feeds of daycare centers are common, but the Army wants to take their kid-monitoring capabilities to the next level. Under a new pilot program being rolled out at a Fort Jackson, S.C. child-care center, the military is looking for service providers to layer commercially available facia...
The vulnerability of the eDocLib platform for storing and processing corporate data lies in the insufficient verification of input data. This allows a malicious actor to alter the execution sequence of programs and gain access to system reference materials without having the necessary access rights.
The vulnerability of the eDocLib platform for storing and processing corporate data is related to insufficient validation of input data. Users who do not have permission to access certain system reference guides including the access management reference guide may gain access to these guides throu...
vulhub
This is an open-source collection of pre-built vulnerable docker environments. It is a repository for testing and demonstrating various vulnerabilities in different applications and frameworks. The repository contains a variety of vulnerable environments, including web applications, databases, an...
Umbrella_android - Digital And Physical Security Advice App
Umbrella is an Android mobile app developed by Security First that provides human rights defenders with the information on what to do in any given security situation and the tools to do it. It allows the user to choose what they want to do, such as: protect data; securely make a call/email;...
pentest-wiki
This repository is an information gathering library for penetration testers and researchers, containing various tools and documentation for gathering information about a target organization. The repository includes scripts and guides for performing whois searches, querying whois databases, and...
Kali Linux 2020.4 - Penetration Testing and Ethical Hacking Linux Distribution
Time for another Kali Linux release! – Kali Linux 2020.4. This release has various impressive updates: ZSH is the new default shell – We said it was happening last time, Now it has. ZSH. Is. Now. Default. Bash shell makeover – It may not function like ZSH, but now Bash looks like ZSH. Partnership...
musicguides.us Cross Site Scripting vulnerability OBB-1354629
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
reservation.chamonix-guides.com Cross Site Scripting vulnerability OBB-1272735
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
raebel.de Cross Site Scripting vulnerability OBB-1264316
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
my.ece.nus.edu.sg Cross Site Scripting vulnerability OBB-1242385
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Default credentials
One of the wireless interfaces within MiR100, MiR200 and possibly according to the vendor other MiR fleet vehicles comes pre-configured in WiFi Master Access Point mode. Credentials to such wireless Access Point default to well known and widely spread SSID MiRRXXXX and passwords omitted. This...
Hardcoded credentials
Out of the wired and wireless interfaces within MiR100, MiR200 and other vehicles from the MiR fleet, it's possible to access the Control Dashboard on a hardcoded IP address. Credentials to such wireless interface default to well known and widely spread users omitted and passwords omitted. This...
CVE-2020-10270
CVE-2020-10270 affects MiR robotic fleet (MiR100/MiR200, potentially others) where the Control Dashboard is reachable on a hardcoded IP via wired/wireless interfaces. The flaw enables control of the robot through default, widely known credentials, as documented in past guides, and may be extended...