CVE-2023-0654

Due to a misconfiguration, the WARP Mobile Client 6.29 for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on...

CVE-2023-0654 Spoofing User's Activity Loads in WARP Mobile Client (Android)

Due to a misconfiguration, the WARP Mobile Client 6.29 for Android was susceptible to a tapjacking attack. In the event that an attacker built a malicious application and managed to install it on a victim's device, the attacker would be able to trick the user into believing that the app shown on...

CVE-2023-0654

CVE-2023-0654 affects the WARP Mobile Client for Android, prior to version 6.29. The vulnerability results from a misconfiguration that allows tapjacking, enabling a malicious app to deceive users into thinking the attacker’s UI is the WARP client (spoofing user activity loads). Evidence across m...

CVE-2022-38060

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla. A misconfiguration in /etc/sudoers within a container can lead to increased privileges. Mitigation /etc/sudoers within the container should use the securepath option to prevent the PATH environment variable...

CVE-2023-39291

A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system...

CVE-2023-39290

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 22.24.5800.0 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view syst...

CVE-2023-39290

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 22.24.5800.0 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view syst...

CVE-2023-39291

A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system...

Mitel MiVoice Connect 安全漏洞

Mitel MiVoice Connect is Mitel Canada's software for centralized management of Mitel Networks' call processing and collaboration tools. A security vulnerability exists in Mitel MiVoice Connect, which stems from a misconfiguration, and through which an attacker could successfully conduct an accoun...

MOXA ioLogik 4000 Series 安全漏洞

MOXA ioLogik 4000 Series is a series of general-purpose controllers from China-based MOXA. A security vulnerability exists in MOXA ioLogik 4000 Series v1.6 and earlier versions, which stems from the session cookie attribute not being set correctly, potentially allowing user session data to be...

OPTO 22 SNAP PAC S1 资源管理错误漏洞

The OPTO 22 SNAP PAC S1 is a controller from OPTO 22 USA. A security vulnerability exists in the OPTO 22 SNAP PAC S1 R10.3b firmware version, which stems from If the controller has the built-in web server enabled, but the built-in web server is not fully setup and configured, an attacker exploiti...

WordPress Hide My WP Ghost Plugin <= 5.0.25 is vulnerable to Bypass Vulnerability

Software Hide My WP Ghost Type Plugin Vulnerable versions = 5.0.25 Fixed in 5.0.26 OWASP Top 10 A6: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-34001 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 5c19175f6894 Credits konagash Required...

Mobileiron MobileIron Sentry 安全漏洞

MobileIron Sentry is a Smart Gateway product from MobileIron, Inc. A security vulnerability exists in MobileIron Sentry 9.18.0 and earlier versions, which stems from an insufficiently restricted Apache HTTPD configuration, allowing an attacker to bypass authentication controls on the management...

WordPress Cartpauj Register Captcha Plugin <= 1.0.02 is vulnerable to Bypass Vulnerability

Software Cartpauj Register Captcha Type Plugin Vulnerable versions = 1.0.02 Fixed in 2.0.0 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-40673 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2347148519cf Credits qilin99 Require...

Thales Group SafeNet Authentication Service 安全漏洞

Thales Group SafeNet Authentication Service is an authentication service from Thales Group, a French company. A security vulnerability exists in SafeNet Authentication Service version 3.4.0, which stems from a misconfiguration of logging privileges. An attacker could use this vulnerability to cau...

Broadcom RAID Controller Security Vulnerability

The Broadcom RAID Controller is a series of RAID controllers from Broadcom Corporation USA. A security vulnerability exists in the Broadcom RAID Controller that stems from a misconfiguration of permissions in the web interface's log file, which makes the product susceptible to attack...

Huawei HarmonyOS misconfiguration vulnerability (CNVD-2023-64500)

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a misconfiguration vulnerability that stems from a configuration flaw in the media module. An attacker can exploit the...

CVE-2023-40256

A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the...

CVE-2023-40256

A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the...

CVE-2023-40256

A vulnerability was discovered in Veritas NetBackup Snapshot Manager before 10.2.0.1 that allowed untrusted clients to interact with the RabbitMQ service. This was caused by improper validation of the client certificate due to misconfiguration of the RabbitMQ service. Exploiting this impacts the...