8077 matches found
CVE-2021-0235
On SRX1500, SRX4100, SRX4200, SRX4600, SRX5000 Series with SPC2/SPC3, vSRX Series devices using tenant services on Juniper Networks Junos OS, due to incorrect permission scheme assigned to tenant system administrators, a tenant system administrator may inadvertently send their network traffic to...
CVE-2021-0400
In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of location data to emergency services due to improper input validation. This could lead to incorrect reporting of location data to emergency services with User execution privilege...
PT-2021-18153 · Apache · Apache Solr
Name of the Vulnerable Software and Affected Versions: Apache Solr versions prior to 8.8.2 Description: The issue arises when Apache Solr is started with specific configurations, such as the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider, and there is no existing security.json...
OutSystems Platform Server Server Cross-Site Request Forgery Vulnerability
Outsystems OutSystems Platform is a set of enterprise-level low-code development platform from OutSystems Outsystems. The platform is mainly used for the visual development of applications. A server cross-site request forgery vulnerability exists in OutSystems Platform Server, which can be...
CVE-2021-29357
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...
CVE-2021-29357
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...
Server side request forgery (ssrf)
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...
CVE-2021-29357
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...
CVE-2021-29357
The ECT Provider component in OutSystems Platform Server 10 before 10.0.1104.0 and 11 before 11.9.0 and LifeTime management console before 11.7.0 allows SSRF for arbitrary outbound HTTP requests...
CVE-2021-29357
The CVE-2021-29357 issue is tied to OutSystems Platform Server’s ECT Provider component. Affected versions : OutSystems Platform Server 10 prior to 10.0.1104.0 and 11 prior to 11.9.0, as well as LifeTime management console prior to 11.7.0. Vulnerability : Server-side request forgery (SSRF) enable...
OutSystems Platform 代码问题漏洞
Outsystems OutSystems Platform is a set of enterprise-level low-code development platform from OutSystems Outsystems. The platform is mainly used for the visual development of applications. A server cross-site request forgery vulnerability exists in OutSystems Platform Server, which can be...
LG mobile 安全漏洞
LG mobile is a line of mobile device products from LG. A security vulnerability exists in LG mobile devices with Android OS 4.4 through 11 software, which can be exploited by an attacker to bypass access controls for specific content providers using ISMS services...
How Cyrebro Can Unify Multiple Cybersecurity Defenses to Optimize Protection
Many enterprises rely on more than one security tool to protect their technology assets, devices, and networks. This is particularly true for organizations that use hybrid systems or a combination of cloud and local applications. Likewise, companies whose networks include a multitude of smartphon...
Call Center Provider Experiences Major Data Leak
By Habiba Rashid The exposed data was being updated in realtime with new logs while 1.48 million robocall logs were accessed by researchers initially. This is a post from HackRead.com Read the original post: Call Center Provider Experiences Major Data Leak...
A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37 10.3 before 10.3.28 10.4 before 10.4.18 and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untrusted search path leads to eval injection in which a database SUPER user can execute OS commands after modifying wsrep_provider and wsrep_notify_cmd. NOTE: this does not affect an Oracle product.
...
CVE-2021-21411 Incorrect authorization in OAuth2-Proxy
OAuth2-Proxy is an open source reverse proxy that provides authentication with Google, Github or other providers. The --gitlab-group flag for group-based authorization in the GitLab provider stopped working in the v7.0.0 release. Regardless of the flag settings, authorization wasn't restricted...
Insurance Giant CNA Hit with Novel Ransomware Attack
A novel ransomware attack forced insurance giant CNA to take systems offline and temporarily shutter its website. The attack occurred earlier this week and leveraged a new variant of the Phoenix CryptoLocker malware. The Chicago-based company—the seventh largest commercial insurance provider in t...
Dumping LSASS in memory undetected using MirrorDump
Introduction As I am sure some of you are aware from the occasional ramblings and screenshots on twitter, I am a big fan of .NET based offensive tooling. Not because it’s trendy or cool, but because of the development speed and ease of testing and debugging in comparison to C/C++. A month or so a...
ThinkApe system suffers from information leakage vulnerability
Scope ®️ is part of Shanghai Yingce Information Technology Co., Ltd, a financial shared service solution provider in China. An unauthorized access vulnerability exists in the ThinkApe system, which can be exploited by attackers to obtain sensitive information...