IBM Security Access Manager Information Disclosure Vulnerability (CNVD-2017-01412)

IBM Security Access Manager is a security access manager from IBM USA. A security vulnerability exists in IBM Security Access Manager that originates from an incorrect security configuration. An attacker could exploit the vulnerability to obtain sensitive information...

Popular iOS Apps Vulnerable to TLS Interception Attacks

Dozens of iOS mobile banking, medical and other applications handling sensitive user information are vulnerable to man-in-the-middle attacks where TLS traffic can be intercepted. Of the 76 apps analyzed by Sudo Security Group, 19 are considered high-risk where financial or medical credentials, or...

EAP: Sensitive data can be exposed at the server level in domain mode

It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information...

Uber: Chained Bugs to Leak Victim's Uber's FB Oauth Token

The Facebook OAuth application was misconfigured to allow any URL that followed the https://auth.uber.com/login? format to be provided as a redirecturi. By taking advantage of this, @ngalog was able to discover that the nexturl parameter could be added to the redirecturi allowing it to be chained...

CVE-2016-3017

CVE-2016-3017 affects IBM Security Access Manager (ISAM) products. The root cause is security misconfigurations that could allow a remote attacker to obtain sensitive information. Affected are IBM Security Access Manager for Web 7.0 appliances (7.0.0), 8.0 appliances (all firmware versions), IBM ...

Hacking Guatemala’s DNS – Spying on Active Directory Users By Exploiting a TLD Misconfiguration

Guatemala City, By Rigostar Own work CC BY-SA 3.0, via Wikimedia Commons. UPDATE: Guatemala has now patched this issue after I reached out to their DNS administrator and with a super quick turnaround as well! In search of new interesting high-impact DNS vulnerabilities I decided to take a look at...

Hacking Guatemala’s DNS – Spying on Active Directory Users By Exploiting a TLD Misconfiguration

Guatemala City, ByRigostar Own work CC BY-SA 3.0, via Wikimedia Commons. UPDATE: Guatemala has now patched this issue after I reached out to their DNS administrator and with a super quick turnaround as well! In search of new interesting high-impact DNS vulnerabilities I decided to take a look at...

CVE-2016-8443

Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.18. Android ID: A-32576499. References: QC-CR964185...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! I discovered a publicy accessible internal statistics module in the Army system. The module was outdated and unused, however, it disclosed some...

U.S. Dept Of Defense: Information disclosure vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that could have exposed sensitive information. Thank you @sp1d3rs for notifying us of this! I discovered a publicy accessible internal admin/superadmin interface. The problem was fixed by restricting the access to this interface...

Someone Hijacking Unsecured MongoDB Databases for Ransom

Nearly two years back, we warned users about publicly accessible MongoDB instances – almost 600 Terabytes TB – over the Internet which require no authentication, potentially leaving websites and servers at risk of hacking. These MongoDB instances weren't exposed due to any flaw in its software, b...

U.S. Dept Of Defense: Misconfigured password reset vulnerability on a DoD website

A Department of Defense website was mis-configured such that the password reset function could be bypassed to change a user's password. @mthirup was able to demonstrate this vulnerability by crafting a specially formatted URL. Thanks @mthirup!...

Cisco Warns of Critical Flaw in CloudCenter Orchestrator Systems

Cisco Systems released a critical security bulletin for a vulnerability that could allow an attacker to gain root privileges on affected CloudCenter Orchestrator systems. The company released workaround instructions to mitigate the flaw along with making a software fix available for download. “Th...

Gratipay: Session Fixation At Logout /Session Misconfiguration

Dear Suppport Team , Commonly After Logout time , session should destroy and then new session should be created .. But in your application , it is not possible and same sessioncookie is there before logout and after logout from your application . For further details please find the attachment...

Error: "An authentication request was made before establishing a web session"

When going through the NetScaler, the following error is seen in the Event Viewer: An authentication request was made before establishing a web session. This typically occurs when sticky load-balancing between client and StoreFront is misconfigured...

Cisco CloudCenter Orchestrator Docker Engine Privilege Escalation Vulnerability

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator CCO; formerly CliQr could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system. The vulnerability is due to a misconfiguration that causes the Docker...

U.S. Dept Of Defense: Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████

Details: There is currently a security misconfiguration on plain.php function located on the host http://██████████/ allowing attackers to include webserver contents of their choosing no restriction on filetypes and/or IP addresses, as well as embed malicious javascript payloads in the response v...

U.S. Dept Of Defense: File upload vulnerability on a DoD website

A Department of Defense website was misconfigured in a manner that may have allowed an attacker to bypass tests for malicious files when uploading content. @korprit was able to demonstrate this vulnerability by altering the file sufficiently to defeat signature based analysis. Thanks @korprit!...

U.S. Dept Of Defense: Information disclosure on a DoD website

A Department of Defense website was misconfigured to disclose potentially sensitive system and user information. @mr47 was able to demonstrate this vulnerability by requesting specific web files. Thanks @mr47!...

Legal Robot: S3 ACL misconfiguration

Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...