5098 matches found
GoDaddy Leaks ‘Map of the Internet’ via Amazon S3 Cloud Bucket Misconfig
UPDATE GoDaddy, the world’s largest domain name registrar, has exposed high-level configuration information for tens of thousands of systems and competitively sensitive pricing options for running those systems in Amazon AWS, thanks to yet another cloud storage misconfiguration. The documents wer...
Security update for cups (moderate)
This update for cups fixes the following issues: The following security vulnerabilities were fixed: - CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. bsc1061066 bsc1087018 - Fixed a local...
CVE-2017-1396
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342...
New Relic: DNS misconfiguration on email.alerts.newrelic.com
While checking the subdomains i found that the subdomain email.alerts.newrelic.com upon navigating downloads a file saying "Mailgun Magnificent API" And has the following DNS info screenshot attached The problem lies in this issue: You add the domain email.alerts.newrelic.com to Mailgun Mailgun...
SUSE-SU-2018:2172-1 Security update for cups
This update for cups fixes the following issues: The following security vulnerabilities were fixed: - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend bsc1096405 - CVE-2018-4181: Limited...
Huawei Backup App v6.30.52.12.L - Session Vulnerability
Document Title: =============== Huawei Backup App v6.30.52.12.L - Session Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1815 Video: https://www.vulnerability-lab.com/getcontent.php?id=1987 Release Date: ============= 2018-07-30...
CVE-2018-10905
CloudForms Management Engine cfme is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user...
CVE-2018-4183
A Sandbox bypass has been discovered in cups on macOS due to profile misconfiguration. An attacker that has obtained sandboxed root access can use this flow to escape the sandbox...
Thousands of U.S. Voter Personal Records Leaked by Robocall Firm
Researchers have discovered yet another misconfigured repository bucket – this time leaking the information of U.S. voters. The information was exposed on a public Amazon S3 bucket by a Virginia-based political campaign and robocalling company called Robocent. Kromtech Security researchers, who...
CVE-2018-13787
CVE-2018-13787 affects certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products. The issue is a misconfigured Descriptor Region that could allow OS programs to modify firmware. IBM Power Systems advisories (POWER8/POWER9) reference addressing this CVE via firmware updates...
Read: Our Top Picks for 2018’s Biggest Cybersecurity Stories… So Far
Our threat research team's been burning the candle at both ends this year, what with the sheer number of nasties out there at any given time. But with so many to choose from, how did we populate a list with just seven cybersecurity threats, and why? For one, it'll take the rest of the year to...
HackerOne: Blind SSRF on errors.hackerone.net due to Sentry misconfiguration
Summary: When setting up Sentry you should turn off "source code scrapping". If it is turned on, then server that has Sentry on it will make blind get requests everywhere controlled from outside via error reporting. Description: Hello Hackerone team. In your CSP I found ?sentrykey parameter, so i...
openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication
OpenShift and Atomic Enterprise Ansible deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users to conne...
pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules authz.evaluateOrder=allow,deny, then allow rules will...
CVE-2018-1085
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users...
Error: "Cannot Complete Your Request" Due to DNS Misconfiguration on StoreFront
The following error is displayed due to DNS misconfiguration on StoreFront: Cannot Complete Your Request...
Error: "Cannot Complete Your Request" Due to Citrix Delivery Services Authentication App Pool Misconfiguration on StoreFront
The following error is displayed due to Citrix delivery services authentication app pool misconfiguration on StoreFront: Cannot Complete Your Request...
Error: "Cannot Complete Your Request" Due to Call Back URL Misconfiguration on StoreFront
The following error is displayed due to call back URL misconfiguration on StoreFront: Cannot Complete Your Request...