5479 matches found
2023 OWASP Top-10 Series: API8:2023 Security Misconfiguration
Welcome to the 9th post in our weekly series on the new 2023 OWASP API Security Top-10 list, with a particular focus on security practitioners. This post will focus on API8:2023 Security Misconfiguration. In this series we are taking an in-depth look at each category – the details, the impact and...
Trellix: default credentials at https://52.42.105.71/
Default credentials were used to gain unauthorized access to a server at the reported IP address. The website was misconfigured, allowing login with default admin account credentials. The password should be changed or account disabled to remediate...
CVE-2023-29463 Pavilion8 Security Misconfiguration Vulnerability
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session...
CVE-2023-29463 Pavilion8 Security Misconfiguration Vulnerability
The JMX Console within the Rockwell Automation Pavilion8 is exposed to application users and does not require authentication. If exploited, a malicious user could potentially retrieve other application users’ session data and or log users out of their session...
A security community success story of mitigating a misconfiguration
Learn about the process of preventing security issues by changing things outside of your environment by looking at how a misconfiguration was occurring when Github Actions were integrated with AWS IAM roles and the improvements made that have now made this misconfiguration much less likely...
GHSA-3Q5P-3558-364F Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...
Fiber unauthorized access vulnerability in `ctx.IsFromLocal()`
Impact This vulnerability can be categorized as a security misconfiguration. It impacts users of our project who rely on the ctx.IsFromLocal method to restrict access to localhost requests. If exploited, it could allow unauthorized access to resources intended only for localhost. In it's...
RPC Portmapper Service Public WAN (Internet) / Public LAN Accessible
The script checks if the target host is running a RPC Portmapper service accessible from a public WAN Internet / public LAN. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Oracle Linux 8 : ibus / and / glib2 (ELSA-2020-1880)
The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1880 advisory. 2.56.4-8 - Backport patches for GDBus auth Resolves: 1777213 Tenable has extracted the preceding description block directly from the Oracle Linux security...
The vulnerability of the Apache Hadoop distributed development and execution platform, related to the improper assignment of permissions for files, allows a hacker to circumvent access restrictions on files.
The vulnerability of the Apache Hadoop distributed development and execution platform is related to the improper assignment of permissions for files. Exploiting this vulnerability allows a malicious actor to circumvent restrictions on file access remotely...
CVE-2020-10132
SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration...
Design/Logic Flaw
SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration...
CVE-2020-10132
The CVE-2020-10132 entry concerns SearchBlox before Version 9.1, vulnerable due to cross-origin resource sharing misconfiguration. Affected software is SearchBlox (prior to 9.1); root cause is CORS misconfiguration that can affect cross-domain requests. Documented impact is limited to misconfigur...
CVE-2020-10132 CVE-2020-10132
SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration...
CVE-2020-10132 CVE-2020-10132
SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration...
WordPress FileOrganizer Plugin <= 1.0.2 is vulnerable to Arbitrary File Download
Software FileOrganizer Type Plugin Vulnerable versions = 1.0.2 Fixed in 1.0.3 OWASP Top 10 A5: Security Misconfiguration Classification Arbitrary File Download CVE CVE-2023-3664 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID 1dc652566f23 Credits Dmitrii Required privilege...
Jenkins Plugin Job Configuration History Code Issue Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
WordPress Activity Log Plugin < 2.8.8 is vulnerable to Bypass Vulnerability
Software Activity Log Type Plugin Vulnerable versions 2.8.8 Fixed in 2.8.8 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-4281 Patch priority Low CVSS severity Low 5.3 Developer Elementor PSID 7011dff59d10 Credits Bartlomiej Marek and Tomasz Swiadek...
Apache Superset 代码问题漏洞
Apache Superset is a data visualization and data exploration platform from the Apache USA Foundation. Apache Superset version 2.1.0 and prior versions suffer from an authorization issue vulnerability that stems from incorrect REST API permissions. An attacker can exploit this vulnerability to cau...
WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)
Software Sunshine Photo Cart Type Plugin Vulnerable versions 3.0.0 Fixed in 3.0.0 OWASP Top 10 A6: Security Misconfiguration Classification Insecure Direct Object References IDOR CVE CVE-2023-41796 Patch priority Low CVSS severity Low 5.3 Developer WP Sunshine PSID 684b84aa11e3 Credits yuyudhn...