CVE-2021-39767

In miniadb, there is a possible way to get read/write access to recovery system properties due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. An elevation of privilege vulnerability exists in Google Android, which stems from insecure defaults in miniadb. An attacker could exploit this vulnerability to cause a local elevation of privilege...

Denial Of Service (DoS)

udisks2 is vulnerable to denial of service. The vulnerability exists because some user-accessible mount helpers use insecure defaults which allows an attacker to send a crafted image causing an application crash...

GHSA-34P9-F4Q3-C4R7 Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

Improper Certificate Validation in openssl

All versions of rust-openssl prior to 0.9.0 contained numerous insecure defaults including off-by-default certificate verification and no API to perform hostname verification. Unless configured correctly by a developer, these defaults could allow an attacker to perform man-in-the-middle attacks...

The vulnerability of the user management utilities useradd and adduser in the operating system “OSnova” lies in the use of insecure default settings, which allow attackers to gain access to protected information.

The vulnerability of the user management utilities useradd and adduser in the operating system is related to the use of insecure default settings. Exploiting this vulnerability can allow an attacker to gain access to protected information...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android has a security vulnerability where an eavesdropping vector may exist in onCreate of RequestPermissionActivity.java due to insecure default values. This could lead to a local...

Insecure Default Configuration

Overview Affected versions of socket.io are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default. Recommendation Update to version 2.4.0 or later. References - GitHub Advisory - Snyk Advisory...

Intel SSD Toolbox Default Configuration Issue Vulnerability

A Default Configuration Issue vulnerability exists in Intel SSD Toolbox that arises from the use of insecure default configurations on networked systems or products...

CentOS 8 : pki-deps:10.6 (CESA-2019:1529)

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:1529 advisory. - tomcat: Open redirect in default servlet CVE-2018-11784 - tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins...

GHSA-49WP-QQ6X-G2RF Cross-site Request Forgery in fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

Cross-site Request Forgery in fastify-csrf

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

CORS misconfiguration in socket.io

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...

CVE-2020-28481

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...

AZL-44430 CVE-2020-28481 affecting package js-jquery 3.5.0-4

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...

CVE-2020-28481

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...

Default credentials

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default...

CVE-2020-28482 Cross-site Request Forgery (CSRF)

This affects the package fastify-csrf before 3.0.0. 1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: cookieOpts: path: '/', sameSite: true 2. The CSRF token was available in the GET query parameter...

CVE-2020-28481

CVE-2020-28481 affects the socket.io package prior to 2.4.0, where an insecure default configuration enables CORS misconfiguration with all domains whitelisted by default. This misconfiguration can lead to cross-origin information disclosure according to multiple sources. The issue is fixed by up...

Socketio Socket.io Access Control Error Vulnerability

Socketio Socket.io is a Javascript-based server-side application from the Socketio community that supports event-based bidirectional communication. A security vulnerability exists in socket.io before 2.4.0, which stems from a CORS misconfiguration and is prone to insecure default values...