The vulnerability of the Android operating system allows a perpetrator to gain access to protected information in the TrustZone.

The vulnerability of the Android operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the protected TrustZone area by utilizing the kernel...

New Relic: https://rpm.newrelic.com/.htaccess file is world readable

Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://rpm.newrelic.com/.htaccess to become world readable, as you can see from the information below and th...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of the Bluetooth component in the Android operating system is related to security configuration errors. Exploiting this vulnerability allows a hacker to execute arbitrary code by gaining access to the local physical environment...

Coinbase: Misconfiguration in 2 factor allows sensitive data expose

For some users, Coinbase was accidentally revealing the last 8 digits of a user's phone number on the 2FA modal instead of the last 4 digits. I found that 2 factor page disclose mobile number of user...

Ubiquiti Inc.: Auth bypass on directory.corp.ubnt.com

The researcher ebrietas demonstrated that access to our Internal corporate directory could be gained due to a misconfiguration in Google OpenID. This involved using a non-UBNT Google account and modification to the URL. The issue was resolved and the researcher was awarded a bounty for his...

Apache Karaf Default Credentials Command Execution

This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x. The 'karaf' user has a known default password, which can be used to login to the SSH service, and execute operating system commands from remote. Module Options msf use...

The vulnerability of the Windows operating system allows a perpetrator to circumvent existing access restrictions or establish a connection for an account with a empty password.

The vulnerability of the RDP service implementation in the Windows operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or establish a connection for an account with a empty password using a...

The vulnerability of the Windows operating system, which allows a hacker to circumvent access restrictions to the file system

The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to circumvent restrictions on access to the file system locally...

Shopify: Full access to Amazon S3 bucket containing AWS CloudTrail logs

An Amazon S3 bucket used internally by Shopify was misconfigured, allowing external users to read, write and list objects. The excess permissions have been removed...

UBUNTU-CVE-2015-8787

The nfnatredirectipv4 function in net/netfilter/nfnatredirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured...

CVE-2015-7216

The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image...

sudo -- potential privilege escalation via symlink misconfiguration

MITRE reports: sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home///file.txt."...

ManageEngine AssetExplorer Multiple Vulnerabilities

The version of ManageEngine AssetExplorer running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A path...

ManageEngine ServiceDesk Plus Multiple Vulnerabilities

The version of ManageEngine ServiceDesk Plus running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A pat...

The vulnerability of the Windows operating system, which allows a perpetrator to bypass the secure loading mechanism

The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the trusted boot process by using a specially crafted BCD configuration...

Correction: BMC-2015-0005: File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting

Enigmail: ????? ????? ????????? ?? ???? ??????????? ??? ????????? Errata: This is a correction of our previous disclosure email from September 23rd, 2015. Our previous posting implied that the security vulnerability we discovered was in the "BIRT Viewer" servlet itself. This is NOT the case, but...

CVE-2015-5643

The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors...

The vulnerability of the Firefox browser, which allows a hacker to gain access to protected information

The vulnerability of Firefox browsers is related to the lack of protection for service data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to protected information through specially crafted JavaScript code that exploits errors in the configuration of...

CVE-2015-5643

CVE-2015-5643 affects ICZ MATCHA INVOICE: installer flaw during database configuration allows an unauthenticated attacker to execute arbitrary PHP code on the server. Impact is code injection (CWE-94) via the installer for MATCHA INVOICE 2.5.6 and earlier. Remediation guidance in connected docs i...

SAP Fixes A Dozen Vulnerabilities in HANA

SAP patched a dozen holes in its in-memory management system, HANA, that could have led to SQL injection attacks, cross-site scripting XSS errors, and memory corruption vulnerabilities. Many of the bugs were addressed by the company months ago, but it wasn’t until Tuesday that Onapsis, the securi...