GSA Bounty: Server Side Misconfiguration (EMAIL SPOOFING)

Hi team, Bug Type: Server Security Misconfiguration Mail Server Misconfiguration Missing SPF on Email Domain Weakness: Improper Authentication Description: i observe this when i send a email from [email protected] through http://emkei.cz/ to email [email protected] and afte...

The vulnerability of the lockscreen component of the Android operating system allows a hacker to bypass the PIN code lock.

The vulnerability of the Android operating system’s lock screen is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the PIN code lock by pressing the backspace key after each entry when entering the PIN...

Weblate: Weblate |Security Misconfiguration| Method Enumeration Possible on domain

Hi Team, I have found an instance in application where application is alllowing OPTIONS method to be processed in HTTP request from weblate.org and in response to my request i got the information that these methods are allowed by application server "GET, HEAD, OPTIONS" Ideally server should not...

The vulnerability of the iOS operating system, which allows a perpetrator to make phone calls to arbitrary numbers

The vulnerability of the Quick Look component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to make phone calls to arbitrary numbers remotely...

The vulnerability of the iOS operating system allows a perpetrator to make phone calls to arbitrary numbers.

The vulnerability of the iOS operating system’s Phone component is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to make telephone calls to arbitrary numbers using a third-party application...

The vulnerability of the iOS operating system and the Safari browser allows a hacker to replace the user interface of the FaceTime application.

The vulnerability of the Safari component of the iOS operating system and the Safari browser is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to replace the FaceTime application’s user interface using a specially crafted web page...

The vulnerability of the iOS operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Local Authentication component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker, operating locally, to compromise the confidentiality, integrity, and accessibility of protected information by...

The vulnerabilities in operating systems such as Mac OS X and iOS allow attackers to replace the specified code.

The vulnerability of the AppleMobileFileIntegrity component in operating systems such as Mac OS X and iOS is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to replace the specified code using a special command identifier...

Trend Micro Control Manager download.php Information Disclosure

An information disclosure vulnerability exists in Trend Micro Control Manager. The vulnerability is due to security misconfiguration which allows access to the unreferenced download.php file, which in turn allow reading of the arbitrary files...

The vulnerability of the iOS operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the SpringBoard component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability can allow an attacker, operating locally, to compromise the confidentiality, integrity, and accessibility of protected information through...

The vulnerability of the iOS operating system allows a hacker to execute arbitrary code with administrator privileges.

The vulnerability of the Find My iPhone component in the iOS operating system is related to security configuration errors. Exploiting this vulnerability could allow a local attacker to execute arbitrary code with administrator privileges...

IBM Security Access Manager Information Disclosure Vulnerability (CNVD-2017-01412)

IBM Security Access Manager is a security access manager from IBM USA. A security vulnerability exists in IBM Security Access Manager that originates from an incorrect security configuration. An attacker could exploit the vulnerability to obtain sensitive information...

The vulnerability of the Libraries component of the Java Platform allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Libraries component of the Java Platform software platform is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to compromise the confidentiality, integrity, and accessibility of protected information...

The vulnerability of the Java Platform software platform allows a perpetrator to cause partial service interruption.

The vulnerability of components in the Java Platform software framework is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause partial service interruptions through network packets...

The vulnerability of the Oracle VM VirtualBox virtual machine allows a hacker to gain access to data reading, modify data, or cause a partial service failure.

The vulnerability of the GUI component of the Oracle VM VirtualBox lies in security configuration errors. Exploiting this vulnerability allows a malicious actor to gain read access to data, modify, add, or delete data, or cause partial service failure through HTTP requests...

Popular iOS Apps Vulnerable to TLS Interception Attacks

Dozens of iOS mobile banking, medical and other applications handling sensitive user information are vulnerable to man-in-the-middle attacks where TLS traffic can be intercepted. Of the 76 apps analyzed by Sudo Security Group, 19 are considered high-risk where financial or medical credentials, or...

U.S. Dept Of Defense: Remote File Inclusion, Malicious File Hosting, and Cross-site Scripting (XSS) in ████████

Details: There is currently a security misconfiguration on plain.php function located on the host http://██████████/ allowing attackers to include webserver contents of their choosing no restriction on filetypes and/or IP addresses, as well as embed malicious javascript payloads in the response v...

The vulnerability of the Microsoft Office software package, which allows a hacker to bypass the ASLR protection mechanism

The vulnerability of the Click-to-Run package for Microsoft Office programs is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass the ASLR protection mechanism by using a specially created application...

The vulnerability of the GNU Wget download manager, which allows a hacker to modify any files at will

The vulnerability of the GNU Wget download manager is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to remotely modify any files by redirecting requests from HTTP to a specially created FTP server...

The vulnerability of Google Chrome browser allows a violator to circumvent access restrictions.

The vulnerability of the Google Chrome browser’s blink component is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass access restrictions by using a Java script that utilizes the blink API in its operation...