Code injection

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

CVE-2020-29041

A misconfiguration in Web-Sesame 2020.1.1.3375 allows an unauthenticated attacker to download the source code of the application, facilitating its comprehension code review. Specifically, JavaScript source maps were inadvertently included in the production Webpack configuration. These maps contai...

CVE-2020-29041

The CVE-2020-29041 entry describes a misconfiguration in Web-Sesame 2020.1.1.3375 where JavaScript source maps were included in production Webpack config, allowing an unauthenticated attacker to download the application’s source code and related artifacts (bundle sources, configuration settings s...

Google Android Input Validation Error Vulnerability

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android OS has a security vulnerability that arises from errors in the configuration of a networked system or product during operation, which can be exploited by unauthorized...

Google Android Information Disclosure Vulnerability

Google Android is a Linux-based open source operating system from the USGoogleOpen Handheld Alliance Google. Google Android suffers from an information disclosure vulnerability that arises from errors in the configuration of a networked system or product during operation, which could be exploited...

No Magic TeamworkCloud Security Breach

No Magic TeamworkCloud is a storage management software for collaborative development and version model storage from No Magic, Inc. The software provides a web-based management interface that offers features such as managing user accounts, access control, LDAP integration, secure connections and...

Clario: Google API key leaks and security misconfiguration leads Open Redirect Vulnerability

Summary: Hello, when i search your targets and javascript files I found an googleapikey leaks in url = https://account.clario.co/js/main.044af6485f6b0cd90809.js. Part of the leak down below; 'https://firebasedynamiclinks.googleapis.com/v1/shortLinks?key=AIzaSyAw-SpLHVTIP3IFEIkckCuEmIhnUrY9OrQ';...

Zego: Firebase Database Takeover in Zego Sense Android app

Hello Team, Summary: publicly available Firebase Database api-project-615509201590.firebaseio.com Platform Affected: android com.zegocover.zego Steps To Reproduce: in res/values/strings.xml https://api-project-615509201590.firebaseio.com POC: Go to...

CVE-2020-24578

CVE-2020-24578 concerns the D‑Link DSL-2888A router with firmware prior to AU_2.31_V1.1.47ae55. A misconfigured FTP service permits a malicious network user to access system folders and download sensitive files (e.g., password hash files). Affected product: D‑Link DSL-2888A; root cause: misconfig...

Apache TomEE JMX Vulnerability (CVE-2020-13931)

Apache TomEE is prone to a misconfiguration vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; yo...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

Input validation

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

Apache TomEE Authorization Issues Vulnerability

Apache TomEE is the United States Apache Software Apache Foundation of a lightweight Java EE application server . A security vulnerability exists in Apache TomEE versions 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5, which originates from the use of the embedded ActiveMQ proxy...

CVE-2020-13931

CVE-2020-13931 : Apache TomEE with embedded ActiveMQ broker and a misconfigured broker config can open a JMX port (TCP 1099) without authentication, for TomEE versions 8.0.0-M1–8.0.3, 7.1.0–7.1.3, 7.0.0-M1–7.0.8, and 1.0.0–1.7.5. This edge case was not covered by the prior fix for CVE-2020-11969,...

CVE-2020-13931

If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creatio...

SolarWinds N-Central Access Control Error Vulnerability

SolarWinds N-Central is an IT device management platform from SolarWinds Singapore. The platform provides proactive monitoring of everything on a customer's network, not just servers and workstations, and rapid troubleshooting using features such as MFA, antivirus, integrated endpoint detection a...

Apache TomEE 授权问题漏洞

Apache TomEE is the United States Apache Software Apache Foundation of a lightweight Java EE application server . A security vulnerability exists in Apache TomEE versions 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5, which originates from the use of the embedded ActiveMQ proxy...

CVE-2020-25618

An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root i.e., the use of root privileges is not limited to specific programs listed in the sudoers fi...

SolarWinds N-Central 操作系统命令注入漏洞

SolarWinds N-Central is an IT device management platform from SolarWinds Singapore. The platform provides proactive monitoring of everything on a customer's network, not just servers and workstations, and rapid troubleshooting using features such as MFA, antivirus, integrated endpoint detection a...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...