[SECURITY] Fedora 35 Update: gitjacker-0.0.2-6.fc35

Leak git repositories from misconfigured websites...

GO-2022-0252 Panic on misconfigured IP address in github.com/cloudflare/cfrpki

OctoRPKI crashes when a repository returns an ROA with a IP address that contains too many bits...

Zammad's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks

Description Zammad relies on the rackattack.rb file to defend the application against various brute force attacks, including forgotten password requests, ticket submissions, etc. The currently utilized RackAttack.rb file's configuration attempts to prevent password reset requests per IP to 3 per...

Mastadon's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks

Description Mastadon relies on the RackAttack.rb file to manage API throttling in the application through the declaration of absolute paths i.e., /auth/signin. By appending random strings of characters to the end of the directory in a POST request it is possible to bypass brute force protections...

Siemens SINEMA Remote Connect Server 安全漏洞

SINEMA Remote Connect is a remote network management platform that makes it easy to manage tunnel connections VPNs between headquarters, service technicians, and installed machines or plants.A parameter handling error vulnerability exists in Siemens SINEMA Remote Connect Server, which stems from ...

Chatwoot's Misconfigured Rack_Attack.rb Does Not Appropriately Protect Against Brute Force Attacks

Description Chatwoot relies on the rackattack.rb file to defend the application against various brute force attacks. The Chatwoot application fails to prevent brute force attacks against the listed paths when strings are appended to the end of POST directory names. Some protection still exists,...

Jamf Private Access 安全漏洞

Jamf Private Access is a cloud-based solution from Jamf USA, Inc. It is used for remote access. A security vulnerability exists in versions of Jamf Private Access prior to 2022-05-16 that stems from having incorrect access control. An attacker could exploit the vulnerability to access systems in...

Reddit: Misconfigurated login page able to lock login action for any account without user interaction

Summary While observing a few things about the login feature, I found that the account was locked after a certain number of requests. Although this feature is actually added to prevent problems such as rate limit, it is open to account lock attacks by attackers. PoC 1. Save this code as exploit.p...

Personal Data of Tens of Millions of Russians and Ukrainians Exposed Online

By Waqas The trove of data was leaked due to a misconfigured Elasticsearch server and in total it stored 870… This is a post from HackRead.com Read the original post: Personal Data of Tens of Millions of Russians and Ukrainians Exposed Online...

CVE-2022-22978

In spring security versions prior to 5.4.11+, 5.5.7+ , 5.6.4+ and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with . in the regular expression are possibly vulnerable to an...

GHSA-M643-2PFV-XWM8 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API

A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...

Misconfigured ElasticSearch Servers Exposed 579 GB of Users’ Website Activity

By Waqas In total, two misconfigured ElasticSearch servers belonging to an unknown organization exposed 359,019,902 359 million records that were… This is a post from HackRead.com Read the original post: Misconfigured ElasticSearch Servers Exposed 579 GB of Users’ Website Activity...

Amazon Linux 2 : docker (ALASNITRO-ENCLAVES-2022-017)

The version of docker installed on the remote host is prior to 20.10.7-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2022-017 advisory. A file permissions vulnerability was found in Moby Docker Engine. Copying files by using docker cp into a...

Securing AWS Lambda function URLs

Learn about the security risks of misconfigured Lambda function URLs and how to properly secure them...

CVE-2021-27762

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...

Design/Logic Flaw

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...

CVE-2021-27762

CVE-2021-27762 describes misconfigured security-related HTTP headers resulting in missing or misconfigured headers in web responses. Documented impact per CVSSv3.1 shows a high/severe impact on confidentiality, integrity, and availability (C/H/I/A = HIGH). The root cause is misconfigured/missing ...

CVE-2021-27762 HCL BigFix Platform is affected by misconfigured security-related HTTP headers

Misconfigured security-related HTTP headers: Several security-related headers were missing or mis-configured on the web responses...

PT-2022-11528 · Ping Identity · Pingid Desktop

Name of the Vulnerable Software and Affected Versions: PingID Desktop versions prior to 1.7.3 Description: The issue is related to a misconfiguration in the encryption libraries of PingID Desktop, which can lead to sensitive data exposure. An attacker capable of exploiting this issue may be able ...

LemonDuck Cryptomining Botnet Hunting for Misconfigured Docker APIs

By Deeba Ahmed LemonDuck cryptomining botnet previously targeted Microsoft Exchange servers. Now it is targeting the worlds leading containerization platform, Docker.… This is a post from HackRead.com Read the original post: LemonDuck Cryptomining Botnet Hunting for Misconfigured Docker APIs...