5488 matches found
Remote code execution
SonicWall Analytics 2.5 On-Prem is vulnerable to Java Debug Wire Protocol JDWP interface security misconfiguration vulnerability which potentially leads to Remote Code Execution. This vulnerability impacts Analytics On-Prem 2.5.2518 and earlier...
Connected Farms Easy Pickings for Global Food Supply-Chain Hack
A group of hackers made an unnerving DEF CON 29 presentation showing how the sprawling growth of digital and automated farming has left the world’s food supply chain vulnerable to cyberattack. A video for DEF CON 29 hacker conference this week put out by the group Sick Codes explained that modern...
hw: improper isolation of shared resources in some Intel Processors
Microcode misconfiguration in some Intel processors may cause EIBRS mitigation CVE-2017-5715 to be incomplete. As a consequence, this issue may allow an authenticated user to potentially enable information disclosure via local access...
Design/Logic Flaw
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover legitimate apps and to steal user's sensitive information...
CVE-2021-33699
Task Hijacking is a vulnerability that affects the applications running on Android devices due to a misconfiguration in their AndroidManifest.xml with their Task Control features. This allows an unauthorized attacker or malware to takeover legitimate apps and to steal user's sensitive information...
SonicWall Analytics 配置错误漏洞
SonicWall Analytics is a high-performance management and reporting engine for the Web from SonicWall, Inc. A misconfiguration vulnerability exists in SonicWall Analytics 2.5 On-Prem due to a security misconfiguration of the Java Debug Wire Protocol JDWP interface, which can be exploited by an...
Netgear NETGEAR 安全漏洞
Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in Netgear NETGEAR that stems from a security misconfiguration in some NETGEAR devices that affects normal...
hw: improper isolation of shared resources in some Intel Processors
Microcode misconfiguration in some Intel processors may cause EIBRS mitigation CVE-2017-5715 to be incomplete. As a consequence, this issue may allow an authenticated user to potentially enable information disclosure via local access...
Palo Alto Software: DNS Miconfiguration Leads to Subdomain Takeover - max1.liveplan.com
Summary The issue happens due to using EC2 public DNS instead of using Elastic IPs as CNAME record. This report is simliar to report 1069795 Misconfiguration - DNS Records json "host": "max1.liveplan.com", "resolver": "1.0.0.1:53" , "a": "54.68.121.128" , "cname":...
NetApp Cloud Manager 信息泄露漏洞
Netapp NetApp Cloud Manager is an application from Netapp, Inc. which provides centralized orchestration of hybrid cloud storage and data management services. An information disclosure vulnerability exists in NetApp Cloud Manager, which stems from a flaw in the configuration of the product. An...
GHSA-RC7P-GMVH-XFX2 Attack on Kubernetes via Misconfigured Argo Workflows
Impact Users running using the Argo Server with --auth-mode=server which is the default v3.0.0 AND have exposed their UI to the Internet may allow remote users to execute arbitrary code on their cluster, e.g. crypto-mining. Resolution Do not expose your user interface to the Internet. Change...
8x8: DNS Misconfiguration (Subdomain Takeover) - █████████.8x8.com
@melbadry9 reported to us an issue with an A record which pointed to subdomains outside of 8x8's control. This was caused due to a misconfiguration in a script, together with changes in AWS' DNS resolution behaviour. The issue has been rectified...
HackerOne: Internal Gitlab Ticket Disclosure via External Slack Channels
@noneoftheabove was able to enumerate GitLab ticket titles and descriptions by posting links in a shared Slack channel. As part of HackerOne's investigation, it was determined that the misconfiguration could also be used to obtain the contents of exceptions from HackerOne's production environment...
UPchieve: hackers.upchieve.org and argocd.upchieve.org is not preloaded.
POC video : IMG7790.MP4 Vulnerable URLs : https://hstspreload.org/?domain=argocd.upchieve.org and https://hstspreload.org/?domain=hackers.upchieve.org Impact Security Misconfiguration...
Exploit for CVE-2021-36934
ShadowSteal | CVE-2021-36934 Pure Nim implementation for explo...
The vulnerability of Google Chrome browser extensions, related to security configuration errors, allows attackers to access confidential information.
The vulnerability of Google Chrome browsers is related to the insufficient implementation of policies. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...
Misconfigured AWS bucket exposed 421GB of Artwork Archive data
By Deeba Ahmed The trove of data was left exposed unencrypted and without any password or security authentication. This is a post from HackRead.com Read the original post: Misconfigured AWS bucket exposed 421GB of Artwork Archive data...
GitHub Security Lab: [go]: Add query for detecting CORS misconfiguration
This bug was reported directly to GitHub Security Lab...
IBM Cognos Controller Permissions Licensing and Access Control Issues Vulnerability
IBM Cognos Controller is a business intelligence and planning solution from IBM Corporation. The product has features such as process automation, financial audit control, and creation and management of financial reports.IBM Cognos Controller is vulnerable to privilege permission and access contro...
CVE-2020-11634
The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context...