Security misconfiguration in the /json/fe/activeUserFinder.do resource - CVE-2020-4015

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a security misconfiguration...

Security misconfiguration in the /json/fe/activeUserFinder.do resource - CVE-2020-4015

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a security misconfiguration...

Security misconfiguration in the /json/fe/activeUserFinder.do resource - CVE-2020-4015

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a security misconfiguration...

Security misconfiguration in the /json/fe/activeUserFinder.do resource - CVE-2020-4015

The /json/fe/activeUserFinder.do resource in Altassian Fisheye and Crucible before version 4.8.1 allows remote attackers to view user user email addresses via a security misconfiguration...

NETGEAR RAX40 Input Validation Error Vulnerability

The NETGEAR RAX40 is a wireless router from NETGEAR. A security vulnerability exists in the NETGEAR RN42400 prior to version 6.10.2, which stems from a misconfiguration of security settings. No details of the vulnerability are provided at this time...

CVE-2019-20654

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC505 before 8.0.6.4 and WAC510 before 8.0.6.4...

CVE-2019-20648

The CVE-2019-20648 entry concerns NETGEAR RN42400 devices with firmware older than 6.10.2, affected by a misconfiguration of security settings. The issue is documented across multiple sources, stating the vulnerability arises from incorrect security configuration rather than a software flaw in a ...

CVE-2020-10507 ALLE INFORMATION CO., LTD. School Manage System - Security Misconfiguration

The School Manage System before 2020, developed by ALLE INFORMATION CO., LTD., contains a vulnerability of Unrestricted file upload RCE , that would allow attackers to gain access in the hosting machine...

Design/Logic Flaw

For ABB eSOMS 4.0 to 6.0.3, the Cache-Control and Pragma HTTP headers have not been properly configured within the application response. This can potentially allow browsers and proxies to cache sensitive information...

CVE-2019-19000

ABB eSOMS versions 4.0–6.0.3 are affected by CVE-2019-19000 due to improper configuration of Cache-Control and Pragma HTTP headers in application responses, which can allow browsers/proxies to cache sensitive information. The issue is documented in multiple sources (NVD entry for CVE-2019-19000 a...

CVE-2018-16266

The Enlightenment system service in Tizen allows an unprivileged process to fully control or capture windows, due to improper D-Bus security policy configurations. This affects Tizen before 5.0 M1, and Tizen-based firmwares including Samsung Galaxy Gear series before build RE2...

The vulnerability of the SAP HANA database management system, related to security configuration errors, allows attackers to execute arbitrary commands with root privileges.

The vulnerability of the SAP HANA database management system is related to security configuration errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...

U.S. Dept Of Defense: Bypassing CORS Misconfiguration Leads to Sensitive Exposure

Hi! Security Team @deptofdefense, It's possible to get information about the users registered such as: id, name, login name, etc. without authentication in Wordpress via API on . ███████. Description: By default Wordpress allow public access to Rest API to get informations about all users...

The vulnerability of the Live Share extension of the Microsoft Visual Studio software allows a hacker to redirect users to a malicious URL.

The vulnerability of the Live Share extension of the Microsoft Visual Studio development tool is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to redirect users to a malicious URL by convincing them to connect to a specially created Live Share...

The vulnerability of Google Chrome’s browser, related to security configuration errors, allows a malicious actor to gain unauthorized access to local files.

The vulnerability of Google Chrome is related to security settings errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to local files through a specially created Chrome extension...

The vulnerability of Blink’s web page display mechanism in Google Chrome browser allows a hacker to gain unauthorized access to local files.

The vulnerability of Blink’s web page rendering mechanism in Google Chrome browsers is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files through a specially created HTML page...

New Relic: Disclosure of locally served nerdpacks due to nr-local.net CORS policy misconfiguration

Hey team, I've discovered that webserver which serves NR1 nerdpacks locally after nr1 nerdpack:serve is executed allows cross-origin requests from every subdomain of nr-ext.net. Since the nr-ext.net domain is used as a sandbox for user-supplied apps, an attacker can place there a malicious code...

The vulnerability of UEFI (BIOS) software on HP workstations allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of UEFI BIOS software on HP workstations is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information, provided that the TPM module is disabled...

TYPO3 8.5.x <= 8.7.26 and 9.x.x <= 9.5.7 Security Misconfiguration Vulnerability

TYPO3 CMS is susceptible to a security misconfiguration vulnerability. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Grammarly: Lack of CSRF header validation at https://g-mail.grammarly.com/profile

Hello! Description I found that setting up a CORS in some places will check the protocol, but it allows using http scheme. In addition, any subdomain is considered trusted. If the origin is http://www.grammarly.com, then the server will respond: Access-Control-Allow-Origin:...