5875 matches found
CVE-2016-1369
The Adaptive Security Appliance ASA 5585-X FirePOWER Security Services Processor SSP module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misconfigures kernel logging, which allows remote attackers to cause a denial of service resource consumption, and inspection outage or module outa...
CVE-2016-1369
The Adaptive Security Appliance ASA 5585-X FirePOWER Security Services Processor SSP module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misconfigures kernel logging, which allows remote attackers to cause a denial of service resource consumption, and inspection outage or module outa...
CVE-2016-1369
The Adaptive Security Appliance ASA 5585-X FirePOWER Security Services Processor SSP module for Cisco ASA with FirePOWER Services 5.3.1 through 6.0.0 misconfigures kernel logging, which allows remote attackers to cause a denial of service resource consumption, and inspection outage or module outa...
The vulnerability of the Android operating system allows a perpetrator to gain access to protected information in the TrustZone.
The vulnerability of the Android operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to the protected TrustZone area by utilizing the kernel...
New Relic: https://rpm.newrelic.com/.htaccess file is world readable
Normally, only the web server is allowed to read the .htaccess file, but in this case, it appears that there is a misconfiguration that is causing the contents of the .htaccess located at https://rpm.newrelic.com/.htaccess to become world readable, as you can see from the information below and th...
The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code
The vulnerability of the Bluetooth component in the Android operating system is related to security configuration errors. Exploiting this vulnerability allows a hacker to execute arbitrary code by gaining access to the local physical environment...
Coinbase: Misconfiguration in 2 factor allows sensitive data expose
For some users, Coinbase was accidentally revealing the last 8 digits of a user's phone number on the 2FA modal instead of the last 4 digits. I found that 2 factor page disclose mobile number of user...
Ubiquiti Inc.: Auth bypass on directory.corp.ubnt.com
The researcher ebrietas demonstrated that access to our Internal corporate directory could be gained due to a misconfiguration in Google OpenID. This involved using a non-UBNT Google account and modification to the URL. The issue was resolved and the researcher was awarded a bounty for his...
Apache Karaf Default Credentials Command Execution
This module exploits a default misconfiguration flaw on Apache Karaf versions 2.x-4.x. The 'karaf' user has a known default password, which can be used to login to the SSH service, and execute operating system commands from remote. Module Options msf use...
The vulnerability of the Windows operating system allows a perpetrator to circumvent existing access restrictions or establish a connection for an account with a empty password.
The vulnerability of the RDP service implementation in the Windows operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing access restrictions or establish a connection for an account with a empty password using a...
The vulnerability of the Windows operating system, which allows a hacker to circumvent access restrictions to the file system
The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to circumvent restrictions on access to the file system locally...
Shopify: Full access to Amazon S3 bucket containing AWS CloudTrail logs
An Amazon S3 bucket used internally by Shopify was misconfigured, allowing external users to read, write and list objects. The excess permissions have been removed...
UBUNTU-CVE-2015-8787
The nfnatredirectipv4 function in net/netfilter/nfnatredirect.c in the Linux kernel before 4.4 allows remote attackers to cause a denial of service NULL pointer dereference and system crash or possibly have unspecified other impact by sending certain IPv4 packets to an incompletely configured...
CVE-2015-7216
The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted JPEG 2000 image...
sudo -- potential privilege escalation via symlink misconfiguration
MITRE reports: sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multiple wildcards in /etc/sudoers, as demonstrated by "/home///file.txt."...
ManageEngine AssetExplorer Multiple Vulnerabilities
The version of ManageEngine AssetExplorer running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A path...
ManageEngine ServiceDesk Plus Multiple Vulnerabilities
The version of ManageEngine ServiceDesk Plus running on the remote web server is affected by multiple vulnerabilities : - A security bypass vulnerability exists due to a misconfiguration in web.xml that allows access to the URL /workorder/FileDownload.jsp without requiring authentication. - A pat...
The vulnerability of the Windows operating system, which allows a perpetrator to bypass the secure loading mechanism
The vulnerability of the Windows operating system’s kernel is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the trusted boot process by using a specially crafted BCD configuration...
Correction: BMC-2015-0005: File inclusion vulnerability caused by misconfiguration of "BIRT Viewer" servlet as used in BMC Remedy AR Reporting
Enigmail: ????? ????? ????????? ?? ???? ??????????? ??? ????????? Errata: This is a correction of our previous disclosure email from September 23rd, 2015. Our previous posting implied that the security vulnerability we discovered was in the "BIRT Viewer" servlet itself. This is NOT the case, but...