Former AWS Engineer Arrested as Capital One Admits Massive Data Breach

A massive breach of Capital One customer data has hit more than 100 million people in the U.S. and 6 million in Canada. Thanks to a cloud misconfiguration, a hacker was able to access to credit applications, Social Security numbers and bank account numbers in one of the biggest data breaches to...

Host Header Injection

invenio-app is vulnerable to host header injection. The attack exists because it only relies on APPALLOWEDHOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header...

Ahsay Systems Cloud Backup Suite Information Disclosure Vulnerability

Ahsay Systems Cloud Backup Suite is a cloud-based backup software suite from Ahsay Systems. An information disclosure vulnerability exists in Ahsay Systems Cloud Backup Suite versions prior to 8.1.1.50. The vulnerability stems from an error in configuration, etc. in the operation of a networked...

Paragon Initiative Enterprises: Github wikis are editable by anyone https://github.com/paragonie/password_lock/wiki

submitted a misconfiguration in some of our GitHub repositories to us. Wikis are inherently editable for all users, but for some repositories an organization may want to restrict this access. In some cases it was possible for GitHub users . Github wikis on the following project...

Ping Identity: Session misconfiguration on forget password feature at https://ort-admin.pingone.com

Summary: After looking into session related bugs , i can see that Session misconfiguration on forget password feature at https://ort-admin.pingone.com Steps To Reproduce: 1 go to https://ort-admin.pingone.com and login as user-A in browser-A 2 go to https://ort-admin.pingone.com and click on forg...

Kartpay: Error Page Content Spoofing or Text Injection [https://vpn.kartpay.com/]

VPN URL is accessible to the Public which is a misconfiguration of VPN Setup. So the Setup has been fixed and only internal network can access the VPN systems,...

Redbrick Technologies Shift Information Disclosure Vulnerability (CNVD-2019-38845)

Redbrick Technologies Shift is a suite of application platforms from Redbrick Technologies, a Canadian company. The platform supports managed access to email, chat programs, network storage, and more. An information disclosure vulnerability exists in Redbrick Technologies Shift 3.4.3 and prior...

Palo Alto Networks PAN-OS Information Disclosure Vulnerability (CNVD-2019-23068)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An information disclosure vulnerability exists in Palo Alto Networks PAN-OS. to The vulnerability originates from an error in configuration or other errors in the operation of the network...

Ping Identity: Session misconfiguration on change password feature at https://apps-staging.pingone.com/myaccount/?environmentId=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx#

Summary: After loooking into session related issue , i can see that there is session misconfiguration on change password feature at https://apps-staging.pingone.com Steps To Reproduce: 1 go to https://apps-staging.pingone.com/myaccount/?environmentId=XXXXX and login as user-A in browser-A 2 go to...

TYPO3 8.5.x <= 8.7.26 and 9.x.x <= 9.5.7 Security Misconfiguration Vulnerability

TYPO3 CMS is susceptible to a security misconfiguration vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

virt-bootstrap Information Disclosure Vulnerability

virt-bootstrap is a tool to set the root filesystem for libvirt-based containers. An information disclosure vulnerability exists in virt-bootstrap version 1.1.0. The vulnerability stems from an error in the configuration, etc. of a networked system or product during operation. An unauthorized...

CVE-2019-3949

Arlo Basestation firmware 1.12.0.127940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device...

Code injection

Arlo Basestation firmware 1.12.0.127940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device...

CVE-2019-3949

Arlo Basestation firmware 1.12.0.127940 and prior firmware contain a networking misconfiguration that allows access to restricted network interfaces. This could allow an attacker to upload or download arbitrary files and possibly execute malicious code on the device...

CVE-2019-3949

CVE-2019-3949 involves Arlo Basestation firmware (≤1.12.0.1_27940) with insufficient UART protection. If an attacker gains physical access and connects to the UART port, they can reach the device login prompt and potentially obtain sensitive information, aided by hardcoded UART credentials. Relat...

Invoxia NVX220 Information Disclosure Vulnerability

The Invoxia NVX220 is an IP telephone from the French company Invoxia. An information disclosure vulnerability exists in Invoxia NVX220. The vulnerability stems from an error in the configuration, etc., of a network system or product during operation. An unauthorized attacker could exploit the...

GE Aviation Passwords, Source Code Exposed in Open Jenkins Server

A public Jenkins server owned by GE Aviation has exposed source code, plaintext passwords, global system configuration details and private keys from the company’s internal commercial infrastructure. GE Aviation, a subsidiary of General Electrics, is among the top commercial aircraft engine...

Exploit for CVE-2007-2447

This is a proof-of-concept PoC exploit repository for various...

Security Camera Firm Arlo Zaps High-Severity Bugs

Two high-severity vulnerabilities in Arlo Technologies’ wireless home security camera gear have been patched. The flaws, which indirectly impact Arlo’s popular fleet of wireless home security cameras, are limited to adversaries with local network and physical access to Arlo Base Stations. Both...

Account Takeover Vulnerability Found in Popular EA Games Origin Platform

A popular gaming platform used by hundreds of millions of people worldwide has been found vulnerable to multiple security flaws that could have allowed remote hackers to takeover players' accounts and steal sensitive data. The vulnerabilities in question reside in the "Origin" digital distributio...