Millions of Golfers Land in Privacy Hazard After Cloud Misconfig

Finding cloud databases with sensitive information left open to the internet has become par for the course these days – as a new exposure of millions of sensitive data points for the users of a golf app demonstrates. Millions of golfer records from the Game Golf app, including GPS details from...

Bluetooth Flaw Found in Google Titan Security Keys; Get Free Replacement

A team of security researchers at Microsoft discovered a potentially serious vulnerability in the Bluetooth-supported version of Google's Titan Security Keys that could not be patched with a software update. However, users do not need to worry as Google has announced to offer a free replacement f...

Apache Tomcat 9.0.x < 9.0.10 Security Misconfiguration

Binary data 700707.pasl...

Apache Tomcat 9.0.x < 9.0.10 Multiple Vulnerabilities

Binary data 700708.pasl...

LocalTapiola: CORS misconfiguration allows to steal customers data

Issue The reporter found an issue with CORS configurations in one of our applications. The misconfiguration allowed the hacker to leak and steal a logged on users information. Leaking much data would take quite some time, but it would also be a question of waiting for as many customets to log on...

TYPO3 Multiple Vulnerabilities (TYPO3-CORE-SA-2019-011, TYPO3-CORE-SA-2019-012, TYPO3-CORE-SA-2019-013)

TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if description...

Security Misconfiguration in User Session Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...

Security Misconfiguration in User Session Handling

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-011...

SAP Gateway ACL Misconfiguration Remote Code Execution

An ACL Misconfiguration vulnerability exists in SAP Gateway. Successful exploitation of this vulnerability could lead to remote code execution on the affected system. Aka "10KBLAZE"...

Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...

Security Misconfiguration since TYPO3 9.4.0

Salted Passwords was bundled in TYPO3 as ext:saltedpasswords and got merged with the core component ext:core with TYPO3 v9.4.0 see documentation of issue 85833...

The vulnerability of Junos OS’ firewall filter configuration allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of Junos OS’ firewall filter configuration is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

ZEIT: Gitlab Oauth Misconfiguration Lead To Account Takeover

Summary: Hello I found that you did not specify which link to redirect with Token Gitlab Allowing the attacker to exploit this vulnerability to force the user to redirect his Gitlab Token To the attacker's site , And Take Over The Account of user Steps To Reproduce: 1. Access To...

openSUSE Security Update : apache2 (openSUSE-2019-1190)

This update for apache2 fixes the following issues : - CVE-2019-0220: The Apache HTTP server did not use a consistent strategy for URL normalization throughout all of its components. In particular, consecutive slashes were not always collapsed. Attackers could potentially abuse these...

Microsoft Open Enclave SDK Information Disclosure Vulnerability

Microsoft Open Enclave SDK is a Microsoft SDK Software Development Kit for building secure zone applications in C and C ++. An information disclosure vulnerability exists in the Open Enclave SDK, which arises from errors such as configuration during operation of a networked system or product. An...

ZOHO ManageEngine ServiceDesk Plus Information Disclosure Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP is the United States ZhuoHao ZOHO company's set of ITIL-based architecture of IT service management software. The software integrates incident management, problem management, asset management IT project management, procurement and contract management and oth...

Cross-Site Scripting

Overview All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine, harp does not sanitize the HTML output allowing attackers to run arbitrary JavaScript when processing malicious files. Recommendation No fix is currently available. Consider usin...

Apache HTTP Server < 2.4.39 mod_http2 DoS Vulnerability - Linux

When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an Upgrade request from http/1.1 to http/2 that was not the first request on a connection could lead to a misconfiguration and crash. A server that never enabled the h2 protocol or that only enabled it for...

Apache HTTP Server < 2.4.39 Multiple Vulnerabilities

Binary data 700509.prm...

Apple iOS and Apple macOS Mojave iBooks Component Misconfiguration Vulnerability

Apple iOS and Apple macOS Mojave are both products of Apple Inc. Apple iOS is an operating system for mobile devices. apple macOS Mojave is a specialized operating system for Mac computers. iBooks is an e-book component of iBooks. A misconfiguration vulnerability exists in the iBooks component in...