5114 matches found
Yii Incorrectly Implements CORS
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
GHSA-927H-X4QJ-R242 github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
GHSA-2H9C-34V6-3QMR Kubernetes in OpenShift3 Access Control Misconfiguration
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...
Kubernetes in OpenShift3 Access Control Misconfiguration
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image...
HCL Technologies HCL Unica Platform 代码问题漏洞
HCL Technologies HCL Unica Platform is an enterprise automated marketing platform from HCL Technologies India.A security vulnerability exists in versions of HCL Technologies HCL Unica Platform prior to 12.1.1, which stems from an improperly configured XML parser that processing user-supplied inpu...
Microsoft Windows Remote Desktop Protocol 信息泄露漏洞
Microsoft Windows Remote Desktop Protocol RDP is an application used to connect to remote Windows desktops from Microsoft Corporation USA.Microsoft Windows Remote Desktop is vulnerable to information disclosure. The vulnerability stems from a configuration or other error in the operation of the...
Microsoft Windows Remote Access Connection Manager 信息泄露漏洞
Microsoft Windows Remote Access Connection Manager is a Windows service from Microsoft that manages virtual private network VPN connections from your computer to the Internet. An information disclosure vulnerability exists in Microsoft Windows Remote Access Connection Manager. The vulnerability...
Microsoft Windows Server Service 信息泄露漏洞
Microsoft Windows is a desktop operating system from Microsoft Corporation USA, and an information disclosure vulnerability exists in Microsoft Windows Server Service. The vulnerability stems from errors in the configuration of the network system or product during operation. An attacker could use...
CVE-2021-42743
A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...
CVE-2021-42743
A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...
Default configuration
A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...
CVE-2021-42743
CVE-2021-42743 is a local privilege escalation in Splunk Enterprise for Windows caused by a misconfiguration of the default node path, enabling a lower-privileged user to gain the Splunk user’s privileges on Splunk Enterprise versions before 8.1.1. Evidence from multiple sources (NVD, Red Hat, Ne...
CVE-2021-42743 Local privilege escalation via a default path in Splunk Enterprise Windows
A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions before 8.1.1 on Windows...
GHSA-XV7J-2V4W-CJVH OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...
Splunk Enterprise 代码问题漏洞
Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...
CVE-2021-41992
A misconfiguration of RSA in PingID Windows Login prior to 2.7 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass...
CVE-2021-41993
A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login...