New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...

DEBIAN-CVE-2019-14822

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...

Exploit for CVE-2019-19268

CVE-2019-19268 Affected Version: rConfig 3.9.2. Descriptio...

CVE-2019-14822

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...

CVE-2019-14822

A flaw was discovered in ibus in versions before 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user who is usi...

CVE-2019-14822

CVE-2019-14822 — ibus local privilege/information exposure . A misconfiguration in the DBus server setup in ibus (versions before 1.5.22) allows any unprivileged user to monitor and send method calls to the ibus bus of another user via the UNIX socket, enabling interception of keystrokes and pote...

ZTE ZXCDN IAMWEB Misconfiguration Vulnerability

ZTE ZXCDN IAMWEB is an authentication product from ZTE Corporation ZTE, China. A configuration error vulnerability exists in ZTE ZXCDN IAMWEB version 6.01.03.01. The vulnerability stems from the existence of unreasonable file configuration, parameter configuration, etc. during the use of a networ...

Shopify: Shopify Stocky App OAuth Misconfiguration

@vulnh0lic noticed that a staff member without Apps permission was able to access the Stocky app. We determined that this was because of a bug in Stocky's OAuth authentication code, which allowed the user to be granted access to Stocky at the start of the OAuth process rather than the end. This...

CVE-2013-4657

Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service...

CVE-2013-4657

The CVE-2013-4657 entry describes a Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L caused by misconfiguration in the SMB service. Affected product(s): NETGEAR WNR3500U and WNR3500L routers. Reported impact in the sources indicates high severity, with the vulnerability enabling p...

CVE-2013-4655

Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service...

Design/Logic Flaw

Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service...

CVE-2013-4655

Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service...

CVE-2013-4656

Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service...

Design/Logic Flaw

Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service...

CVE-2013-4656

The CVE-2013-4656 entry describes a symlink traversal vulnerability in the SMB service caused by misconfiguration on affected devices. The affected products are ASUS RT-AC66U and RT-N56U ; the underlying issue is misconfigured SMB leading to a path traversal vulnerability. Reported impact is seve...

CVE-2013-4656

Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service...

U.S. Dept Of Defense: CORS Misconfiguration Leads to Exposing User Data

Vulnerable Asset: https://██████/█████████/ Discovery: - Upon accessing the site we discover two specific response headers which indicates that a cross-domain request for sensitive information might be possible 1. Access-Control-Allow-Origin: injectable 2. Access-Control-Allow-Credentials: true -...

Dell RSA BSAFE Micro Edition Suite Information Disclosure Vulnerability (CNVD-2019-40481)

Dell RSA BSAFE Micro Edition Suite is an encryption toolkit from Dell USA. An information disclosure vulnerability exists in Dell RSA BSAFE Micro Edition Suite. The vulnerability stems from an error in configuration or other errors in the operation of a networked system or product. An attacker...

openstack-octavia: amphora-agent not requiring client certificate

A certificate-validation error has been found in Octavia's amphora-agent, where an attacker with management-network access could bypass an amphora's client-certificate based authentication. Because the agent's HTTP server gunicorn had 'certreqs' set to 'True' instead of 'ssl.CERTREQUIRED',...