CVE-2018-9526

In device configuration data, there is an improperly configured setting. This could lead to remote disclosure of device location. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112159033...

This Week in Security News: Spam Campaigns and Vulnerable Infrastructures

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. This week, see how cybercriminals have learned to become more creative with malware through spam campaigns. Also, understand why securing energy and...

F5 Networks BIG-IP : TMM vulnerability (K72442354)

Undisclosed traffic patterns may lead to denial of service conditions for the BIG-IP system. The configuration which exposes this condition is the BIG-IP self IP address which is part of a VLAN group and has the Port Lockdown setting configured with anything other than 'allow-all'. CVE-2018-15320...

Ubiquiti Inc.: CORS Misconfiguration leading to Private Information Disclosure

Due to mistake on te CORS policy configuration, the sites https://client.amplifi.com and https://protect.ubnt.com/ CORS policy allowed HTTP requests to be made from certain sites outside the .ubnt.com and .ui.com domains. This bug could be used to steal users information or force the user to...

Zomato: [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive information

Summary: Cross Origin Resource Sharing Misconfiguration | Lead to sensitive information. Description: An HTML5 cross-origin resource sharing CORS policy controls whether and how content running on other domains can perform two-way interaction with the domain that publishes the policy. The policy ...

X (Formerly Twitter): CORS misconfig | Account Takeover

Summary: CORS misconfig is found on niche.co as Access-Control-Allow-Origin is dynamically fetched from client Origin header with credential true and different methods are enabled as well. Description: Basically, the application was only checking whether "//niche.co" was in the Origin header, tha...

CVE-2018-1750

IBM Security Key Lifecycle Manager 3.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 148511...

New Relic: [NR Alerts/Synthetics] IDOR through /policies.json with Synthetics exposes full name of other NR users

This is a similar IDOR that I've reported in the past - but I've found a bypass through a misconfiguration requiring pre-setup in both Alerts and Synthetics to work correctly. I'll show you what I mean: Steps to Reproduce From new user creation page: 1. Add a new user to the account...

CVE-2018-10682

DISPUTED An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using "anonymous" access that is automatically created. Once logged in, a misconfiguration present by default auto-deployment...

CVE-2018-1420

IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 resets access control settings to the out of the box configuration during Combined Cumulative Fix CF installation. This can lead to security miss-configuration of the installation. IBM X-Force ID: 138950...

SAP Hybris Commerce Omni Commerce Connect API Server-Side Request Forgery Vulnerability

SAP Hybris Commerce is a SAP solution for handling high visitor and order volumes in e-commerce, and the Omni Commerce Connect API OCC is one of the full-service connectivity APIs. A server-side request forgery vulnerability exists in OCC in SAP Hybris Commerce version 6. The vulnerability stems...

Chaturbate: Chaturbate "/chat_ignore_list/" endpoint does not check for Account status: Disabled before adding Ignore via POST

Summary Chaturbate.com provides the ability for its users when in chat to ignore other users in chat rooms via DM etc by adding their camhandle name to ignorelist via HUI Actually this is just a POST to /chatignorelist/ getting as a parameter the username which is the camhandle name in order to a...

Chaturbate: Forget password link not expiring after email change.

I found a token miss configuration flaw in chaturbate.com, When we reset password for a user a link is sent to the registered email address but incase it remain unused and email is updated by user from setting panel then too that old token reset link sent at old email address remains valid. A...

CVE-2018-2463

The Omni Commerce Connect API OCC of SAP Hybris Commerce, versions 6., is vulnerable to server-side request forgery SSRF attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC...

Server side request forgery (ssrf)

The Omni Commerce Connect API OCC of SAP Hybris Commerce, versions 6., is vulnerable to server-side request forgery SSRF attacks. This is due to a misconfiguration of XML parser that is used in the server-side implementation of OCC...

CVE-2018-2463

SAP Hybris Commerce OCC API (Omni Commerce Connect) in version 6.* is vulnerable to SSRF due to misconfiguration of the XML parser in the server-side implementation. The issue enables potential unauthorized operations by an attacker who can trigger SSRF requests from the OCC server; impact is des...

CVE-2016-7070

A privilege escalation flaw was found in the Ansible Tower. When Tower before 3.0.3 deploys a PostgreSQL database, it incorrectly configures the trust level of postgres user. An attacker could use this vulnerability to gain admin level access to the database...

Red Hat WildFly IIOP OpenJDK Subsystem Unauthorized Operation Vulnerability

Red Hat Wildfly formerly known as JBoss Application Server is the United States Red Hat Red Hat a JavaEE-based open source application server. IIOP OpenJDK subsystem is one of the Java-based subsystem. A security vulnerability exists in the IIOP OpenJDK subsystem in Red Hat WildFly versions prior...

Starbucks: [mena.starbucks.com] Laravel App Log & Configuration Disclosure.

bobrov discovered a misconfiguration in a Laravel instance at mena.starbucks.com, which exposed log files and environment variables containing database management credentials. The logs have been removed, and the instance of Laravel has been disabled. Thank you @bobrov for finding this...

CVE-2017-2627

A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal...