Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com

Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...

NetApp Cloud Manager 信息泄露漏洞

Netapp NetApp Cloud Manager is an application from Netapp, Inc. which provides centralized orchestration of hybrid cloud storage and data management services. An information disclosure vulnerability exists in NetApp Cloud Manager, which stems from a flaw in the configuration of the product. An...

GHSA-RC7P-GMVH-XFX2 Attack on Kubernetes via Misconfigured Argo Workflows

Impact Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. Resolution Do not expose your user interface to the Internet. Change...

8x8: DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.com

@melbadry9 reported to us an issue with an A record which pointed to subdomains outside of 8x8's control. This was caused due to a misconfiguration in a script, together with changes in AWS' DNS resolution behaviour. The issue has been rectified...

HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels

@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...

UPchieve: hackers.upchieve.org and argocd.upchieve.org is not preloaded.

POC video : IMG7790.MP4 Vulnerable URLs : https://hstspreload.org/?domain=argocd.upchieve.org and https://hstspreload.org/?domain=hackers.upchieve.org Impact Security Misconfiguration...

Exploit for CVE-2021-36934

ShadowSteal | CVE-2021-36934 Pure Nim implementation for explo...

The vulnerability of Google Chrome browser extensions, related to security configuration errors, allows attackers to access confidential information.

The vulnerability of Google Chrome browsers is related to the insufficient implementation of policies. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

Misconfigured AWS bucket exposed 421GB of Artwork Archive data

By Deeba Ahmed The trove of data was left exposed unencrypted and without any password or security authentication. This is a post from HackRead.com Read the original post: Misconfigured AWS bucket exposed 421GB of Artwork Archive data...

GitHub Security Lab: [go]: Add query for detecting CORS misconfiguration

This bug was reported directly to GitHub Security Lab...

IBM Cognos Controller Permissions Licensing and Access Control Issues Vulnerability

IBM Cognos Controller is a business intelligence and planning solution from IBM Corporation. The product has features such as process automation, financial audit control, and creation and management of financial reports.IBM Cognos Controller is vulnerable to privilege permission and access contro...

CVE-2020-11634

The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context...

Unspecified Vulnerability in VIAware

Kramer Electronics VIAware is a wireless presentation collaboration software solution from Kramer Electronics, Israel. A security vulnerability exists in all tested versions of KramerAV VIAWare, which can be exploited by an attacker to elevate privileges via misconfigured sudo...

IBM Cognos Controller 授权问题漏洞

IBM Cognos Controller is a business intelligence and planning solution from IBM Corporation. The product has features such as process automation, financial audit control, and creation and management of financial reports.IBM Cognos Controller is vulnerable to privilege permission and access contro...

CVE-2021-35064

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg...

Design/Logic Flaw

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg...

CVE-2021-35064

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg...

CVE-2021-35064

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg...

CVE-2021-35064

Kramer VIAware (VIAware web interface) is affected by CVE-2021-35064 with concrete details in connected sources: misconfigured sudoers permissions grant privilege escalation by allowing dangerous commands (e.g., unzip, systemctl, dpkg), enabling possible remote code execution patterns. Nuclei tem...

PT-2021-20822

Name of the Vulnerable Software and Affected Versions KramerAV VIAWare affected versions not specified Description The software allows for privilege escalation due to improper sudo configuration. The sudoers file permits the execution of multiple dangerous commands, including unzip, systemctl, an...