sssd: improper implementation of GPOs due to too restrictive permissions

A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict permission settings on the server side, SSSD will allow all authenticated users to login instead of denying access...

Trezor One Information Disclosure Vulnerability

Trezor One is a digital currency wallet device. An information disclosure vulnerability exists in Trezor One devices prior to version 1.8.2. The vulnerability stems from errors such as configuration during operation of a networked system or product. An unauthorized attacker could exploit the...

OnCommand Insight Information Disclosure Vulnerability

NetApp Oncommand Insight is a suite of hybrid cloud data center management software from US-based NetApp. The software provides monitoring and management of multi-vendor IT infrastructure, optimization of storage resource management and other functions. An information disclosure vulnerability...

Google Android System Information Disclosure Vulnerability (CNVD-2019-28627)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. An information disclosure vulnerability exists in System in Android. The vulnerability arises from errors in configuration and other errors in th...

The vulnerability of UEFI (BIOS) software on HP workstations allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of UEFI BIOS software on HP workstations is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, provided that the TPM module is disabled...

Magento Information Disclosure Vulnerability (CNVD-2019-26224)

Magento is an open source PHP e-commerce system of the United States Magento company . The system provides rights management , search engines and payment gateways and other functions. An information disclosure vulnerability exists in Magento version 2.1 before 2.1.18, version 2.2 before 2.2.9, an...

Ansible Tower 3.x < 3.3.5 / 3.4.x < 3.4.3 Privilege Escalation Vulnerability

The version of Ansible Tower running on the remote web server is 3.3.x prior to 3.3.5 or 3.4.x prior to 3.4.3. It is, therefore, affected by a anauthorized access vulnerability due to a RabbitMQ misconfiguration. The configuration does not set a secure channel for messaging celery workers,...

What We Can Learn from the Capital One Hack

On Monday, a former Amazon employee was arrested and charged with stealing more than 100 million consumer applications for credit from Capital One. Since then, many have speculated the breach was perhaps the result of a previously unknown "zero-day" flaw, or an "insider" attack in which the accus...

Former AWS Engineer Arrested as Capital One Admits Massive Data Breach

A massive breach of Capital One customer data has hit more than 100 million people in the U.S. and 6 million in Canada. Thanks to a cloud misconfiguration, a hacker was able to access to credit applications, Social Security numbers and bank account numbers in one of the biggest data breaches to...

Host Header Injection

invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...

Ahsay Systems Cloud Backup Suite Information Disclosure Vulnerability

Ahsay Systems Cloud Backup Suite is a cloud-based backup software suite from Ahsay Systems. An information disclosure vulnerability exists in Ahsay Systems Cloud Backup Suite versions prior to 8.1.1.50. The vulnerability stems from an error in configuration, etc. in the operation of a networked...

Paragon Initiative Enterprises: Github wikis are editable by anyone https://github.com/paragonie/password_lock/wiki

submitted a misconfiguration in some of our GitHub repositories to us. Wikis are inherently editable for all users, but for some repositories an organization may want to restrict this access. In some cases it was possible for GitHub users . Github wikis on the following project...

Ping Identity: Session misconfiguration on forget password feature at https://ort-admin.pingone.com

Summary: After looking into session related bugs , i can see that Session misconfiguration on forget password feature at https://ort-admin.pingone.com Steps To Reproduce: 1 go to https://ort-admin.pingone.com and login as user-A in browser-A 2 go to https://ort-admin.pingone.com and click on forg...

Kartpay: Error Page Content Spoofing or Text Injection [https://vpn.kartpay.com/]

VPN URL is accessible to the Public which is a misconfiguration of VPN Setup. So the Setup has been fixed and only internal network can access the VPN systems,...

Redbrick Technologies Shift Information Disclosure Vulnerability (CNVD-2019-38845)

Redbrick Technologies Shift is a suite of application platforms from Redbrick Technologies, a Canadian company. The platform supports managed access to email, chat programs, network storage, and more. An information disclosure vulnerability exists in Redbrick Technologies Shift 3.4.3 and prior...

Palo Alto Networks PAN-OS Information Disclosure Vulnerability (CNVD-2019-23068)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An information disclosure vulnerability exists in Palo Alto Networks PAN-OS. to The vulnerability originates from an error in configuration or other errors in the operation of the network...

Ping Identity: Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx#

Summary: After loooking into session related issue , i can see that there is session misconfiguration on change password feature at https://apps-staging.pingone.com Steps To Reproduce: 1 go to https://apps-staging.pingone.com/myaccount/?environmentId=XXXXX and login as user-A in browser-A 2 go to...

TYPO3 8.5.x <= 8.7.26 and 9.x.x <= 9.5.7 Security Misconfiguration Vulnerability

TYPO3 CMS is susceptible to a security misconfiguration vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

virt-bootstrap Information Disclosure Vulnerability

virt-bootstrap is a tool to set the root filesystem for libvirt-based containers. An information disclosure vulnerability exists in virt-bootstrap version 1.1.0. The vulnerability stems from an error in the configuration, etc. of a networked system or product during operation. An unauthorized...

CVE-2019-3949

Arlo Basestation firmware 1.12.0.127940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device...