624 matches found
Doctrine Security Misconfiguration Vulnerability
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local...
GHSA-PW5C-XQF2-6XC2 Doctrine Security Misconfiguration Vulnerability
Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 or 2.5.x before 2.5.1, MongoDB ODM before 1.0.2, and MongoDB ODM Bundle before 3.0.1 use world-writable permissions for cache directories, which allows local...
API Security is Necessary to Stop Threats that WAFs and Bot Protection Cannot
Today, there are still API security threats that most WAFs and Advanced Bot Protection solutions cannot manage. In this post, we’ll explain these new types of threats and make some recommendations for features you need within solutions to protect your APIs. When a bad actor makes a completely val...
CVE-2022-24928
Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP...
Security feature bypass
Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP...
CVE-2022-24928
CVE-2022-24928 describes a security misconfiguration in Samsung’s RKP (kernel protection) mechanism prior to the SMR Mar-2022 Release 1. The root cause is a misconfiguration that leaves the system not protected by RKP. As a result, confidentiality, integrity, and availability can be affected on a...
CVE-2022-24928
Security misconfiguration of RKP in kernel prior to SMR Mar-2022 Release 1 allows a system not to be protected by RKP...
lemlist: Security misconfiguration
Description : When we request a magic link to login into the application, and use that same link in multiple browsers, it working there isn't any limit on use of link. Steps to reproduce : 1. go to app.lemilist.com 2. create a magic link 3. use it to login 4. now open another browser or incognito...
MTN Group: Firebase Database Takeover in https://pulseradio.mtn.co.ug/
Summary: During my test , in one of the subdomain of mtn.co.ug I found firebase configuration disclosed in the source code along with apiKey and database URL . Exploiting this vulnerability attacker is able to upload malicious data in the firebase account of pulseradio.mtn.co.ug and see database...
The vulnerability of the Crafter CMS content management system, related to security configuration errors, allows attackers to create, view, and delete search indexes.
The vulnerability of the Crafter CMS content management system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to create, view, and delete search indexes remotely...
CVE-2021-45641
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...
CVE-2021-45640
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.72, D6000 before 1.0.0.72, D6200 before 1.1.00.34, D6220 before 1.0.0.52, D6400 before 1.0.0.86, D7000 before 1.0.1.74, D7000v2 before 1.0.0.53, D7800 before 1.0.1.56, D8500 befor...
CVE-2021-45642
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D7800 before 1.0.1.64, EX6250 before 1.0.0.134, EX7700 before 1.0.0.222, LBR20 before 2.6.3.50, RBS50Y before 2.7.3.22, R8900 before 1.0.5.26, R9000 before 1.0.5.26, XR450 before 2.3.2.66, XR500...
CVE-2021-45643
Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6400v2 before 1.0.4.118, R6700v3 before 1.0.4.118, and XR1000 before 1.0.0.58...
PT-2021-21322 · Synel · Synel Reports +1
Name of the Vulnerable Software and Affected Versions: SYNEL eharmonynew versions prior to 11 Synel Reports versions prior to 11 Synel Reports version 8.0.2 Description: The issue allows an attacker to log in to the system with default credentials and export a report of the eharmony system with...
WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF
The plugin does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack. PoC...
MTN Group: Default Admin Username and Password on remedysso.mtncameroon.net
Summary: A Remedy Single Sign-On Remedy SSO Server is running at https://remedysso.mtncameroon.net/rsso/admin//. It is possible to access the application is using the default Administrator credentials. Steps To Reproduce: Go to https://remedysso.mtncameroon.net/rsso/admin// and login with...
A6: Security Misconfiguration ❗️ — Top 10 OWASP 2017
A6: Security Misconfiguration ❗️ — Top 10 OWASP 2017 Introduction A6: Security Misconfiguration What is Security Misconfiguration? I believe this name was chosen to be as ambiguous as possible for one of the Top 10 OWASP vulnerabilities. It can encompass anything and everything related to...
Sensitive Cookie Without 'HttpOnly' Flag in pi-hole/adminlte
✍️ Description Please enter a description of the vulnerability. The cookie persistentlogin is set without httponly flag 🕵️♂️ Proof of Concept Enable remember me during Login POST /admin/index.php?login HTTP/1.1 Host: 192.168.159.138 Content-Length: 30 Cache-Control: max-age=0...