CVE-2023-25561 Login fail open on JAAS misconfiguration in DataHub

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

Mortgage Broker 8Twelve Exposes Data of Canadian Residents

By Habiba Rashid BAD: In total, the personal records of 717,814 Canadians were exposed to the public as a result of a database misconfiguration. This is a post from HackRead.com Read the original post: Mortgage Broker 8Twelve Exposes Data of Canadian Residents...

India’s Largest Truck Brokerage Company Leaking 140GB of Data

By Waqas The cause of the data leak is an ongoing server misconfiguration, identified by researchers on Shodan, the search engine for IoT devices. This is a post from HackRead.com Read the original post: Indias Largest Truck Brokerage Company Leaking 140GB of Data...

CXF: directory listing / code exfiltration

A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to ...

CXF: directory listing / code exfiltration

A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to ...

Security Bulletin: Vulnerabilities in Spring Framework affects IBM Common Licensing's Administration And Reporting Tool (ART) and its Agent (CVE-2022-22978, 220811)

Summary Security Vulnerablities have been addressed in IBM Common Licensing. In Spring Security versions 5.5.6 and 5.6.3 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. A fix is available to address the vulnerability...

Schneider Electric EcoStruxure Cybersecurity Admin Expert 信任管理问题漏洞

Schneider Electric EcoStruxure Cybersecurity Admin Expert Schneider Electric EcoStruxure CAE is a cybersecurity administration expert from Schneider Electric France. Versions of Schneider Electric EcoStruxure Cybersecurity Admin Expert CAE prior to version 2.2 have a trust management issue...

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Bypass Vulnerability

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.3 Fixed in 3.2.4 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-24373 Patch priority Low CVSS severity Low 3.7 Developer Claim ownership PSID 23810638f6a6 Credi...

CXF: directory listing / code exfiltration

A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to ...

Phoenix Contact PLC Cycle Time Influences Uncontrolled Resource Consumption (CVE-2019-10953)

ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due to a flood of network packets. This plugin only works with Tenable.ot. Please visit...

WordPress Spectra Plugin <= 2.3.0 is vulnerable to Bypass Vulnerability

Software Spectra Type Plugin Vulnerable versions = 2.3.0 Fixed in 2.3.1 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-23730 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID e0584f9e90cf Credits Dave Jong Patchstack Required...

WordPress Name Directory Plugin <= 1.27.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Name Directory Type Plugin Vulnerable versions = 1.27.1 Fixed in 1.27.2 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-22692 Patch priority Low CVSS severity Low 4.3 Developer Jeroen Peters PSID 97cd32d13c24 Credits NeginNrb Require...

TLS Connection Cryptographic Protocol Vulnerabilities

TLS is the backbone of encryption and key to ensuring data integrity, but its misconfiguration can leave your system vulnerable. Read on to discover how to secure your TLS connection and arm your organization against malicious attacks...

WordPress My Tickets Plugin <= 1.9.11 is vulnerable to Other Vulnerability Type

Software My Tickets Type Plugin Vulnerable versions = 1.9.11 Fixed in 1.9.12 OWASP Top 10 A6: Security Misconfiguration Classification Other Vulnerability Type CVE CVE-2023-23988 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 857918c48e0e Credits yuyudhn Required privileg...

Law enforcement app SweepWizard leaks data on crime suspects

SweepWizard, an obscure app apparently created by ODIN Intelligence and used by more than 60 law enforcement departments, has a flaw: According to an ethical hacker, a misconfiguration in the app's API application programming interface caused it to unintentionally leak to the open internet a trov...

CVE-2022-39186

EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions...

Design/Logic Flaw

EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions...

CVE-2022-39186 EXFO - BV-10 Performance Endpoint Unit Misconfiguration

EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions...

CVE-2022-39186 EXFO - BV-10 Performance Endpoint Unit Misconfiguration

EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions...

CVE-2022-39186

CVE-2022-39186 affects EXFO BV-10 Performance Endpoint Unit. The root cause is a misconfigured permissions setting on the system configuration file, as reported by multiple sources (NVD, CNNVD). Potential impact includes high confidentiality exposure, with local attack vector and low attack compl...