5551 matches found
WordPress WPvivid Backup and Migration Plugin <= 0.9.89 is vulnerable to Arbitrary File Deletion
Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.89 Fixed in 0.9.90 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Deletion CVE CVE-2023-4274 Patch priority Low CVSS severity Low 8.7 Developer Claim ownership PSID 578242027a0b Credits Ivan...
CVE-2023-41902
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...
CVE-2023-41902
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...
CVE-2023-41902
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...
Privilege escalation
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...
PT-2023-28157 · Corecode · Macupdater
Name of the Vulnerable Software and Affected Versions: CoreCode MacUpdater versions prior to 2.3.8 CoreCode MacUpdater versions 3.x prior to 3.1.2 Description: An XPC misconfiguration issue allows attackers to escalate privileges by crafting malicious .pkg files. Recommendations: For versions pri...
CVE-2023-41902
CVE-2023-41902 affects CoreCode MacUpdater prior to 2.3.8 and 3.x prior to 3.1.2. An XPC misconfiguration allows privilege escalation by processing crafted malicious .pkg files. Impacts include local attacker access to escalate privileges; no exploitation details are provided in the documents. Re...
CVE-2023-41902
An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...
Microsoft AI Researchers Accidentally Expose 38 Terabytes of Confidential Data
Microsoft on Monday said it took steps to correct a glaring security gaffe that led to the exposure of 38 terabytes of private data. The leak was discovered on the company's AI GitHub repository and is said to have been inadvertently made public when publishing a bucket of open-source training...
CVE-2023-40788
SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...
SpringBlade Security Vulnerability
Bred Network Technology SpringBlade is a suite of microservice development platforms from China's Bred Network Technology. A security vulnerability exists in SpringBlade V3.6.0 and earlier versions, which stems from an incorrect configuration in the default gateway that allows unauthorized...
WordPress Dropbox Folder Share Plugin <= 1.9.7 is vulnerable to Server Side Request Forgery (SSRF)
Software Dropbox Folder Share Type Plugin Vulnerable versions = 1.9.7 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Server Side Request Forgery SSRF CVE CVE-2023-3025 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID d1ee4d4ea4d2 Credits Alex...
2023 OWASP Top-10 Series: API8:2023 Security Misconfiguration
Welcome to the 9th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API8:2023 Security Misconfiguration. In this series we are taking an in-depth look at each category – the details, the impact and...
Trellix: default credentials at https://52.42.105.71/
Default credentials were used to gain unauthorized access to a server at the reported IP address. The website was misconfigured, allowing login with default admin account credentials. The password should be changed or account disabled to remediate...
CVE-2023-29463 Pavilion8 Security Misconfiguration Vulnerability
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session...
CVE-2023-29463 Pavilion8 Security Misconfiguration Vulnerability
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session...
A security community success story of mitigating a misconfiguration
Learn about the process of preventing security issues by changing things outside of your environment by looking at how a misconfiguration was occurring when Github Actions were integrated with AWS IAM roles and the improvements made that have now made this misconfiguration much less likely...
GHSA-3Q5P-3558-364F Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...
RPC Portmapper Service Public WAN (Internet) / Public LAN Accessible
The script checks if the target host is running a RPC Portmapper service accessible from a public WAN Internet / public LAN. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...