CVE-2021-40338 OWASP Related Vulnerabilities in Hitachi Energy’s LinkOne Product

Hitachi Energy LinkOne product, has a vulnerability due to a web server misconfiguration, that enables debug mode and reveals the full path of the filesystem directory when an attacker generates errors during a query operation. This issue affects: Hitachi Energy LinkOne 3.20; 3.22; 3.23; 3.24;...

Hitachi Energy LinkOne 信息泄露漏洞

Hitachi Energy LinkOne is an enterprise graphical parts catalog and content delivery solution from Hitachi Energy, Switzerland. It is used to publish, view and locate spare parts for complex equipment and assemblies. A security vulnerability exists in Hitachi Energy LinkOne, which arises from a...

Hitachi Energy LinkOne 授权问题漏洞

Hitachi Energy LinkOne is an enterprise graphical parts catalog and content delivery solution from Hitachi Energy, Switzerland. It is used to publish, view and find spare parts for complex equipment and assemblies. A security vulnerability exists in Hitachi Energy LinkOne, which stems from a web...

SUSE: Security Advisory (SUSE-SU-2022:0214-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Reolink Rlc-410W 信息泄露漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China. reolink RLC-410W in v3.0.0.13620121102 is vulnerable to information disclosure, which stems from information disclosure due to web server configuration errors. An attacker could use this vulnerability to obtain sensitive information...

Reolink RLC-410W web server misconfiguration information disclosure vulnerability

Summary An information disclosure vulnerability exists due to a web server misconfiguration in the reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability. Tested...

Nextcloud Android app 信息泄露漏洞

Nextcloud Android app is an Android-based mobile application for accessing Nextcloud servers from the German company Nextcloud. information disclosure in versions of Nextcloud Android app prior to 3.17.1, the vulnerability stems from a network system or product that has a configuration and other...

Cisco StarOS 安全漏洞

Cisco StarOS is a virtualized operating system from Cisco. A security vulnerability exists in Cisco StarOS that stems from certain services not having debug mode properly enabled. A remote attacker could use this vulnerability to connect to a device, navigate to a debug mode enabled service, and...

The vulnerability in the implementation of the Transport Layer Security (TLS) protocol of the libcurl library allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Transport Layer Security TLS protocol implementation in the libcurl library is related to errors in security settings when the CURLOPTSSLCIPHERLIST configuration option is used. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gain...

Vulnerabilities fixed in Cisco StarOS Software

Cisco has fixed vulnerabilities in StarOS, the operating system of a series of Aggregation Services Routers ASR. Because the debug mode was misconfigured, a remote malicious party may be able to access sensitive information and may be able to execute arbitrary code under the root privileges of th...

Microweber 信息泄露漏洞

Microweber is an online store management system from the Microweber community in the United States that provides drag-and-drop functionality. The system includes modules for adding products, images, etc. microweber has an information disclosure vulnerability, which stems from errors in the...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. GitLab suffers from a security vulnerability that stems from configuring in a...

MTN Group: Firebase Database Takeover in https://pulseradio.mtn.co.ug/

Summary: During my test , in one of the subdomain of mtn.co.ug I found firebase configuration disclosed in the source code along with apiKey and database URL . Exploiting this vulnerability attacker is able to upload malicious data in the firebase account of pulseradio.mtn.co.ug and see database...

Kubernetes 代码问题漏洞

Kubernetes K8s is an open source system from the Cloud Native Computing Foundation for automating the deployment, scaling, and management of containerized applications. A code issue vulnerability exists in the Kubernetes client that stems from due to a misconfiguration of YAML parsing, which woul...

The vulnerability of the Crafter CMS content management system, related to security configuration errors, allows attackers to create, view, and delete search indexes.

The vulnerability of the Crafter CMS content management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to create, view, and delete search indexes remotely...

Cryptomining Attack Exploits Docker API Misconfiguration Since 2019

Hackers behind a cryptomining campaign have managed to avoid detection since 2019. The attacks exploited misconfigured Docker APIs that allowed them to gain network entry and ultimately sets up a backdoor on compromised hosts to mine cryptocurrency, researchers said. The attack technique is...

TikTok: URL Scheme misconfiguration on TikTok for IOS

A misconfigured URL schema on a TikTok iOS endpoint could have resulted in a user being forced to follow other accounts by visiting a malicious website or HTML page. We thank @glassplant for reporting this to our team...

CVE-2021-45642

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.64, EX6250 before 1.0.0.134, EX7700 before 1.0.0.222, LBR20 before 2.6.3.50, RBS50Y before 2.7.3.22, R8900 before 1.0.5.26, R9000 before 1.0.5.26, XR450 before 2.3.2.66, XR500...

CVE-2021-45641

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...

CVE-2021-45645

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects RBS50Y before 2.7.0.122, SRK60 before 2.7.0.122, SRR60 before 2.7.0.122, SRS60 before 2.7.0.122, SXK30 before 3.2.33.108, SXR30 before 3.2.33.108, SXS30 before 3.2.33.108, and SRC60 before 2.7.0.122...