Apache Airflow SSL Certificate Validation Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform has dynamic and scalable features. A security vulnerability exists in Apache Airflow versions prior to 1.10.1, which stems from the...

TYPO3 Multiple Vulnerabilities (Jan 2019)

TYPO3 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3"; if description...

Security Bulletin: TPM on the Integrated Management Module II (IMM2) of Flex System x222 compute node is not configured correctly (CVE-2014-0881)

Summary The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be exploited to steal keys or to perform 'denial of service' type attacks. Vulnerability Details Abstract The IMM2 TPM on the Flex System x222 compute node is not configured correctly which can be...

Man-in-the-Middle (MitM)

apache-airflow is vulnerable to man-in-the-middle MitM attack. A misconfiguration and improper exceptions checking in the LDAP authentication backend airflow.contrib.auth.backends.ldapauth disabled server certificate checking, and allowed for man-in-the-middle attacks against clients connecting t...

Input validation

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...

CVE-2018-20245

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...

CVE-2018-20245

The LDAP auth backend airflow.contrib.auth.backends.ldapauth prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking...

Security Misconfiguration for Backend User Accounts

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...

Security Misconfiguration for Backend User Accounts

More info at https://typo3.org/security/advisory/typo3-core-sa-2019-002...

Security Misconfiguration for Backend User Accounts

When using the TYPO3 backend in order to create new backend user accounts, database records containing insecure or empty credentials might be persisted. When the type of user account is changed - which might be entity type or the admin flag for backend users - the backend form is reloaded in orde...

Multiple Intel Products Misconfiguration Vulnerability

Intel NUC Kit NUC7CJYH and others are mini mainframe products from Intel Corporation USA. A misconfiguration vulnerability exists in the system firmware in several Intel products. An attacker in close physical proximity could exploit the vulnerability to elevate privileges...

SUSE SLED15 / SLES15 Security Update : cups (SUSE-SU-2018:2172-1)

This update for cups fixes the following issues: The following security vulnerabilities were fixed : - Fixed a local privilege escalation to root and sandbox bypasses in the scheduler - CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend bsc1096405 - CVE-2018-4181: Limited...

CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more...

CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more...

CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more...

U.S. Dept Of Defense: [██████] Cross-origin resource sharing misconfiguration (CORS)

Hi! In this report I want to describe High level bug which can seriously compromise a user account. If I am authorize on this site, I can steal user's sessions, some personal information or do some action. Steps for reproduce 1 Send this request GET...

DEBIAN-CVE-2018-16883

sssd versions from 1.13.0 to before 2.0.0 did not properly restrict access to the infopipe according to the "alloweduids" configuration parameter. If sensitive information were stored in the user directory, this could be inadvertently disclosed to local attackers...

DEBIAN-CVE-2018-20151

In WordPress before 4.9.9 and 5.x before 5.0.1, the user-activation page could be read by a search engine's web crawler if an unusual configuration were chosen. The search engine could then index and display a user's e-mail address and rarely the password that was generated by default...

Cookie Without SameSite Flag Detected

SameSite is an attribute which can be set on a cookie to instruct the web browser if this cookie can be sent along with cross-site requests to help prevent Cross-Site Request Forgery CSRF attacks. The attribute has three possible values : - Strict : the cookie will only be sent in a first-party...

RATELIMITED: Line feed injection in get request leads AWS S3 Bucket information disclosure

Summary: By added line feed control character to the end of url https://ratelimited.me/migration/ it is possible to list elements of bucket name "████████" , also it is possible to view source code of any php file in the bucket such as the php file with key "██████████" which is the...