3179 matches found
Mail.ru: Disable 2FA via CSRF (Leads to 2FA Bypass)
CSRF vulnerability in pandao.ru allowed to disable 2FA. pandao.ru belongs to extended scope...
PT-2019-12186 · Tibco · Tibco Api Exchange Gateway +1
Name of the Vulnerable Software and Affected Versions: TIBCO API Exchange Gateway versions 2.3.1 and prior versions TIBCO API Exchange Gateway Distribution for TIBCO Silver Fabric versions 2.3.1 and prior versions Description: The authorization component of TIBCO API Exchange Gateway contains a...
CVE-2019-11270
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
Design/Logic Flaw
Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the 'clients.write' authority or scope can bypass the restrictions imposed on clients created via 'clients.write' and create clients with arbitrary scopes that the creator does not possess...
API server allows access to custom resources via wrong scope
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L The API server mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the...
Qualys Cloud Platform 2.40 New Features
This release of the Qualys Cloud Platform version 2.40 includes updates and new features for Web Application Scanning, highlights as follows. Web Application Scanning "Everything" Detection Scope – A new detection scope called "Everything" is now available in the option profile. This can be used ...
CVE-2019-11270: UAA clients.write vulnerability | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA versions prior to v73.4.0 contain a vulnerability where a malicious client possessing the ‘clients.write’ authority or scope can bypass the restrictions imposed on clients created via ‘clients.write’ and create clients wi...
Mail.ru: Information Disclosure - Получаем доступ к работам и к приватным презентациям к курсам
Access to course training materials was possible in Geekbrains due to read access to S3-compatible bucket. Geekbrains belongs to extended Ext. B scope...
CVE-2019-2316
CVE-2019-2316 concerns Qualcomm Snapdragon components where a local variable is used after it goes out of scope during digest computation in multiple Snapdragon platforms (MDM9640, QCS405, QCS605, SD 4xx/6xx/7xx series, 710/712/730/845/850/855, SDM660/SDX24, etc.). The root cause is a use-after-s...
CVE-2019-2316
When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730...
Mail.ru: [auto.mail.ru] IDOR на редактирование поста любого юзера.
IDOR allowed to edit arbitrary posts in auto.mail.ru auto.mail.ru belongs to Extended scope IDOR на редактирование произвольного поста на сайте auto.mail.ru...
Palo Alto GlobalProtect SSL VPN remote code execution vulnerability-vulnerability warning-the black bar safety net
One, Foreword Palo Alto GlobalProtect SSL VPN is the enterprise commonly used the SSLVPN products, recently disclosed a remote code execution vulnerability. Second, the vulnerability profile Palo Alto GlobalProtect SSL VPN in/sslmgr position exists format string vulnerability there is a remote co...
Radancy: Developper's websites are easily accessibles leading to massive information disclosure
Domain and URL: .devmaximum.com ███████████.acc.devmaximum.com Hello, I've found a couple hundred of devmaximum websites with personal datas. I know this subdomains are out of scope, i've discovered them with devmaximum.maximum.nl's SSL certificate. But in less than 30 minutes of testing i've...
Mail.ru: CSRF Vulnerability at https://aw.my.com/
CSRF vulnerability allowed to change userbar settings in https://aw.my.com/ https://aw.my.com/ belongs to Ext.B scope...
Redis is not authorized to access high-risk vulnerability alerts-a vulnerability alert-the black bar safety net
Recently, Sangfor security team found that open-source databases Redis broke up an unauthorized access vulnerability, the first time for tracking and analysis of early warning. The study found that the use of the vulnerability, the attacker can achieve rally shell for arbitrary code execution...
CVE-2018-19569
GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnerability that allows access to the web-UI as a user using a Personal Access Token of any scope...
Unauthorized access vulnerability in Weave scope
Weave Scope is an open source project. Weave scope has an unauthorized access vulnerability that can be exploited by attackers to obtain sensitive information...
Intel Turbo Boost Max Technology 3.0 Discontinuation - US
Lenovo Security Advisory: LEN-27841 Potential Impact: Privilege escalation Severity: Medium Scope of Impact: Industry-wide CVE Identifier: CVE-2019-0164 Summary Description: A potential security vulnerability in the Intel Turbo Boost Max Technology 3.0 may allow escalation of privilege. Mitigatio...