CVE-2023-33379

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's...

CVE-2023-33379

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's...

Command injection

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's...

CVE-2023-33379

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's...

CVE-2023-33379

CVE-2023-33379 affects Connected IO v2.1.0 and earlier, due to a misconfiguration in the MQTT broker used for management and device communication. This flaw can let devices connect to the broker and issue commands, impersonating the Connected IO management platform and sending commands to all Con...

Connected IO Security Vulnerability

Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability exists in Connected IO prior to version v2.1.0 that stems from a misconfiguration in the MQTT agent used for management and device communicati...

CVE-2023-33379

Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices to connect to the broker and issue commands to other device, impersonating Connected IO management platform and sending commands to all of Connected IO's...

PT-2023-24324 · Unknown · Connected Io

Name of the Vulnerable Software and Affected Versions: Connected IO versions 2.1.0 and prior Description: The issue is related to a misconfiguration in the MQTT broker used for management and device communication. This misconfiguration allows devices to connect to the broker and issue commands to...

answer Security breach

answer is an open source knowledge-based community software. A security vulnerability exists in versions of answer prior to 1.1.1, which stems from a misconfiguration of permissions that allows low-privileged users to create tags...

Improper Certificate Validation

matrixsydent is vulnerable to Improper Certificate Validation. The vulnerability exists due to the misconfiguration of TLS in emailutils.py, which potentially allows an attacker to preform Man-in-the-Middle MITM attacks resulting in sensitive email disclosure...

WordPress Change wp-admin login Plugin < 1.1.4 is vulnerable to Bypass Vulnerability

Software Change wp-admin login Type Plugin Vulnerable versions 1.1.4 Fixed in 1.1.4 OWASP Top 10 A5: Security Misconfiguration Classification Bypass Vulnerability CVE CVE-2023-3604 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID f402f5411a8e Credits Muhamad Arsyad...

SUSE CVE-2022-38060

A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges...

Red Hat Ansible automation controller 安全漏洞

Red Hat Ansible automation controller is a centralized management tool from Red Hat, Inc. It is used to manage inventory, initiate and schedule workflows, track changes, and integrate reporting with a centralized user interface. A security vulnerability exists in Red Hat Ansible automation...

HackerOne: Takeover of hackerone.engineering via Github

The hacker was able to take over the hackerone.engineering domain after a brief misconfiguration window on GitHub. They claimed the domain in their own repository while the DNS records were still pointing towards GitHub. The issue has been resolved and no malware was found on the site during the...

Cisco Nexus 9000 Series Fabric Switches Application-Centric Infrastructure Mode Privilege Escalation (CVE-2019-1585)

A vulnerability in the controller authorization functionality of Cisco Nexus 9000 Series ACI Mode Switch Software could allow an authenticated, local attacker to escalate standard users with root privilege on an affected device. The vulnerability is due to a misconfiguration of certain sudoers...

Authorization Rule Misconfiguration

spring-security-config is vulnerable to Authorization Rule Misconfiguration. The vulnerability exists due to the lack of validation in the RequestMatcher of AbstractRequestMatcherRegistry.java when the application uses the requestMatchersString function with multiple servlets, one of them being...

WordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open Redirection

Software Integration for WooCommerce and Zoho CRM Type Plugin Vulnerable versions 1.3.7 Fixed in 1.3.7 OWASP Top 10 A5: Security Misconfiguration Classification Open Redirection CVE CVE-2023-38481 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 39fbc1d90c72 Credits Phd...

WordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin <= 4.5.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software WpStream – Live Streaming, Video on Demand, Pay Per View Type Plugin Vulnerable versions = 4.5.4 Fixed in 4.5.5 OWASP Top 10 A6: Security Misconfiguration Classification Cross Site Request Forgery CSRF CVE CVE-2023-38512 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership...

GHSA-4VPR-XFRP-CJ64 Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...

Spring Security's authorization rules can be misconfigured when using multiple servlets

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchersString and multiple servlets, one of them being Spring MVC’s DispatcherServlet. DispatcherServlet is a Spring...