HTTP::Tiny 信任管理问题漏洞

HTTP::Tiny is a small, simple, and correct HTTP/1.1 client from Perldoc Open Source. HTTP::Tiny suffers from a trust management issue vulnerability that stems from having an insecure default TLS configuration where users must opt-in to validate certificates...

Insecure Defaults

Overview fluentd-ui is a web UI for Fluentd Affected versions of this package are vulnerable to Insecure Defaults in the form of a default password, which is not mandatory to change. Remediation There is no fixed version for fluentd-ui. References - GitHub Issue...

CVE-2022-3101

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of...

SUSE CVE-2019-3700

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger...

WordPress plugin SVG Support 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site scripting...

CVE-2022-39395 Vela Insecure Defaults

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. In Vela Server and Vela Worker prior to version 0.16.0 and Vela UI prior to version 0.17.0, some default configurations for Vela allow exploitation and container breakouts. Users should upgrade to...

GHSA-5M7G-PJ8W-7593 Vela Insecure Defaults

Impact Some current default configurations for Vela allow exploitation and container breakouts. Default Privileged Images Running Vela plugins as privileged Docker containers allows a malicious user to easily break out of the container and gain access to the worker host operating system. On a fre...

Red Hat OpenStack Platform 安全漏洞

Red Hat OpenStack Platform is a cloud computing management platform from the US-based Red Hat, Inc. A security vulnerability exists in Red Hat OpenStack Platform versions 16.1 and 16.2, which stems from an insecure default configuration in Tripleo-ansible, where permissions on sensitive files are...

Red Hat OpenStack Platform 安全漏洞

Red Hat OpenStack Platform is a cloud computing management platform from the US-based Red Hat, Inc. A security vulnerability exists in Red Hat OpenStack Platform versions 16.1 and 16.2, which stems from an insecure default configuration in Tripleo-ansible, where permissions on sensitive files are...

SUSE-SU-2022:3154-1 Security update for udisks2

This update for udisks2 fixes the following issues: - CVE-2021-3802: Fixed insecure defaults in user-accessible mount helpers bsc1190606. - Fixed vulnerability that allowed mounting ext4 devices over existing entries in fstab bsc1098797...

CVE-2022-20342

In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from the American company Google. Google Android 13 suffers from a security vulnerability that stems from insecure defaults that could leak WiFi passwords to end users...

Improper Handling of Exceptional Conditions in Newtonsoft.Json

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service DoS. The serialization and...

GHSA-5CRP-9R3C-P9VR Improper Handling of Exceptional Conditions in Newtonsoft.Json

Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of expressions with high nesting level that lead to StackOverFlow exception or high CPU and RAM usage. Exploiting this vulnerability results in Denial Of Service DoS. The serialization and...

GHSA-VFMM-JM4V-7FRQ Apache Wicket insecure defaults

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider...

Apache Wicket insecure defaults

Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider...

Denial Of Service (DoS)

Newtonsoft.Json is vulnerable to denial of service. The use of insecure defaults cause an StackOverFlow exception SOE whenever nested expressions are being processed when an attacker sends 5 requests that cause SOE in time frame of 5 minutes...

Insecure Defaults

github.com/cri-o/cri-o is vulnerable to insecure defaults. The vulnerability exists because its containers started incorrectly with non-empty inheritable Linux process capabilities, allowing an unprivileged user to gain inheritable file capabilities up to the container's bounding set...

Insecure Defaults

directus is using insecure defaults. The use of default CORS settings in the Record function of env.ts which are very permissive for uncontrolled environments allows an attacker to access unauthorized resources in the system...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-28928)

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from insecure defaults in miniadb. An attacker could exploit this vulnerability to cause a local elevation of privilege...