5114 matches found
BSA-2021-1480
Security Advisory ID : BSA-2021-1480 Component : Webtools Revision : 1.0 Webtools in Brocade SANnav before version 2.1.1 allows unauthenticated users to make requests to arbitrary hosts due to a misconfiguration;this is commonly referred to as Server-Side Request Forgery SSRF. Attackers can utili...
Sifchain: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information.
hii team, i found a cors bug in your https://sifchain.finance/ website . Steps To Reproduce: 1. goto https://sifchain.finance/ website and enter email and click signup. 2. intercept via burp ,you will get a request . send to repeater. 3.change the request as POST /==wp-json== HTTP/2 Host:...
Sifchain: CORS Misconfiguration Leads to Sensitive Exposure on Sifchain main domain
Summary: Hello, I know that isn't in the Scope But this The Only Way I can Report With And It Belongs to the Main Domain. ==At first please see all those references given below:== References: https://hackerone.com/reports/768151 https://hackerone.com/reports/1167869...
Sifchain: CORS misconfiguration
Description: Affected website: https://sifchain.finance/wp-json/oembed/1.0/embed?url=https://sifchain.finance/&format=xml Step-by-step Reproduction : 1. Send this request: javascript GET /wp-json/oembed/1.0/embed?url=https://sifchain.finance/&format=xml HTTP/1.1 Host: sifchain.finance...
Hubs Cloud 配置错误漏洞
Hubs Cloud is an application for the Hubs community. All the AWS resources needed to host your own immersive space from your company or organization's own account can be created and managed. A misconfiguration vulnerability exists in Hubs Cloud that stems from a proxy feature built into the...
Sifchain: Misconfiguration Certificate Authority Authorization Rule
Hello,Sifchain Security Team, I found a bug called Missing CAA. Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authoriti...
EulerOS 2.0 SP3 : ibus (EulerOS-SA-2021-1799)
According to the version of the ibus packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another...
CVE-2021-30476
HashiCorp Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1...
CVE-2021-30476
HashiCorp Terraform’s Vault Provider terraform-provider-vault did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1...
CVE-2021-31410
Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request...
SUSE: Security Advisory (SUSE-SU-2018:2162-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
SUSE: Security Advisory (SUSE-SU-2019:2388-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
UPchieve: Zero click account Takeover due to Api misconfiguration 🏂🎩
Hacker reported that full account takeover was possible through exploitation of one our forms. Hacker provided sufficient information to prove capability and how to remediate. Our team remediated the issue so that the takeover is no longer possible. i was able to take over any account without any...
CVE-2021-26076
The jira.editor.user.mode cookie set by the Jira Editor Plugin in Jira Server and Data Center before version 8.5.12, from version 8.6.0 before version 8.13.4, and from version 8.14.0 before version 8.15.0 allows remote anonymous attackers who can perform an attacker in the middle attack to learn...
Pegasystem PEGA Platform Access Control Error Vulnerability
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...
Improper access control
pyActivity in Pega Platform 8.4.0.237 has a security misconfiguration that leads to an improper access control vulnerability via =GetWebInfo...
CVE-2020-15390
CVE-2020-15390 affects Pega Platform (version 8.4.0.237) via the pyActivity component. The root cause is a security misconfiguration that yields improper access control through =GetWebInfo, enabling exposure of sensitive information. Documented impacts are consistent with high/severe risk (NVD re...
Pegasystem PEGA Platform 安全漏洞
Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem UK. The platform is used to develop applications for BPM Business Process Management, Case Management, Real Time Decision Making and CRM Customer Relationship Management. An access control error vulnerability...
PT-2021-15651 · Facebook · Whatsapp Business For Android +1
Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions prior to 2.21.4.18 WhatsApp Business for Android versions prior to 2.21.4.18 Description: A cache configuration issue may have allowed a third party with access to the device’s external storage to read cached TLS...
