5098 matches found
Code injection
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
CVE-2018-20744
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
CVE-2018-20745
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
CVE-2018-20744
The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
CVE-2018-20744
The CVE-2018-20744 entry concerns Olivier Poitrey’s Go CORS handler (versions ≤ 1.3.0). The root cause is that a wildcard CORS policy can be converted to reflect an arbitrary Origin header value, which conflicts with CORS security design and can lead to CORS misconfiguration. Impact described as ...
CVE-2018-20745
Yii 2.x through 2.0.15.1 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems...
PT-2019-10198 · Olivier Poitrey · Go Cors Handler
Name of the Vulnerable Software and Affected Versions: Olivier Poitrey Go CORS handler versions 1.3.0 and earlier Description: The issue arises from the active conversion of a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security desig...
RATELIMITED: Missing Protection Mechanism in Mail Servers allows malicious user to use staff.ratelimited.me email could lead to identity theft.
Hello ratelimited, I'm not really sure how your mail servers being configured but i guess there is a mis-configuration or missing protection mechanism that fails to verify if the email that is going to be sent are only made by authorized ratelimited staff only. From this point of view a malicious...
Apache Airflow SSL Certificate Validation Vulnerability
Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform has dynamic and scalable features. A security vulnerability exists in Apache Airflow versions prior to 1.10.1, which stems from the...
TYPO3 Multiple Vulnerabilities (Jan 2019)
TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if description...
Security Bulletin: TPM on the Integrated Management Module II (IMM2) of Flex System x222 compute node is not configured correctly (CVE-2014-0881)
Summary The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be exploited to steal keys or to perform 'denial of service' type attacks. Vulnerability Details Abstract The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be...
Man-in-the-Middle (MitM)
apache-airflow is vulnerable to man-in-the-middle MitM attack. A misconfiguration and improper exceptions checking in the LDAP authentication backend airflow.contrib.auth.backends.ldapauth disabled server certificate checking, and allowed for man-in-the-middle attacks against clients connecting t...
Input validation
The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...
CVE-2018-20245
The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...
CVE-2018-20245
The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Security Misconfiguration for Backend User Accounts
More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...
Security Misconfiguration for Backend User Accounts
When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...
Multiple Intel Products Misconfiguration Vulnerability
Intel NUC Kit NUC7CJYH and others are mini mainframe products from Intel Corporation USA. A misconfiguration vulnerability exists in the system firmware in several Intel products. An attacker in close physical proximity could exploit the vulnerability to elevate privileges...
SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2018:2172-1)
This update for cups fixes the following issues: The following security vulnerabilities were fixed : - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend bsc1096405 - CVE-2018-4181: Limited...