CVE-2023-20066

A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the filesystem mountpoint of the web UI. This vulnerability is due to an insufficient security configuration. An attacker cou...

PT-2023-2104 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform a directory traversal and access resources that are outside the...

The vulnerability of Microsoft Defender for Endpoint’s Windows operating system allows a hacker to bypass existing security restrictions.

The vulnerability of Microsoft Defender for Endpoint’s Windows operating system is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to bypass existing security restrictions remotely...

GHSA-66M4-GC8H-HPJX Timing attack in eZ Platform Ibexa

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

Timing attack in eZ Platform Ibexa

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

K22441651: BIG-IP TMUI XSS vulnerability CVE-2019-6657

Security Advisory Description A reflected cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Traffic Management User Interface TMUI, also known as the BIG-IP Configuration utility. CVE-2019-6657 Impact An attacker may exploit this vulnerability using a crafted URL ...

SA44588 - 2020-09: Out-of-Cycle Advisory: Multiple vulnerabilities resolved in Pulse Connect Secure / Pulse Policy Secure 9.1R8.2

Edit: 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. This advisory provides information about multiple vulnerabilities resolved in Pulse Connect Secure 9.1R8.2, Pulse Policy Secure 9.1R8.2 Refer to KB43892 - What releases will Pulse Secur...

The vulnerability of the Mozilla Firefox browser, related to security configuration errors, allows a hacker to read arbitrary files.

The vulnerability of the Mozilla Firefox browser is related to security configuration errors. Exploiting this vulnerability allows a remote attacker to read arbitrary files...

The vulnerability of the Edge AutoFill Protection() function in the Microsoft Edge browser allows a perpetrator to disclose protected information.

The vulnerability of the Edge AutoFill Protection function in the Microsoft Edge browser is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to disclose protected information through a specially created link...

CVE-2021-26360

A flaw was found in hw. This flaw allows an attacker with local access to the system to make unauthorized modifications to the security configuration of the SOC registers. This issue could allow potential corruption of the AMD secure processor’s encrypted memory contents, leading to arbitrary cod...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in security configuration errors, allowing attackers to circumvent existing security restrictions.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...

All In One WP Security & Firewall < 5.1.3 - Configuration Leak

The plugin leaked settings of the plugin publicly, including the used email address. Config leak in previous versions: "aiowpsremovewpgeneratormetainfo" filetype:txt https://www.google.com/search?q=%22aiowpsremovewpgeneratormetainfo%22+filetype%3Atxt Search for aiowpsemailaddress...

The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the rsync platform used in OpenStack platforms for cloud computing solutions is related to security configuration errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

IBM WebSphere MQ Denial of Service Vulnerability (CNVD-2022-87643)

IBM WebSphere MQ is a system from International Business Machines IBM, Inc. A denial-of-service vulnerability exists in IBM WebSphere MQ version 7.1. A remote attacker could use this vulnerability to bypass security configuration settings and cause a denial of service...

The vulnerability of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise applications relates to security configuration errors, allowing attackers to disclose protected information.

The vulnerability of Microsoft Excel, Microsoft Office, and Microsoft 365 Apps for Enterprise programs is related to security configuration errors. Exploiting this vulnerability can allow attackers to disclose sensitive information through a specially created file...

CVE-2022-41923 Grails Spring Security Core plugin vulnerable to privilege escalation

Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint i.e. the targeted endpoint using the authorization requirements of a different endpoint i.e. the donor endpoint. In some Grails framework applications, access to t...

CVE-2022-44725

OPC Foundation Local Discovery Server LDS through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS running as a high-privilege user...

The vulnerability of the Netlogon Remote Protocol (MS-NRPC) implementation in Windows operating systems allows a hacker to increase their privileges.

The vulnerability of the Netlogon Remote Protocol MS-NRPC implementation in Windows operating systems is related to security configuration errors. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of the BitLocker Device Encryption security function in Windows operating systems allows attackers to circumvent security restrictions.

The vulnerability of the BitLocker Device Encryption security function in Windows operating systems is related to security configuration errors. Exploiting this vulnerability could allow a hacker to circumvent security restrictions...

The vulnerability of the Mark of the Web operating system mechanism, which allows a hacker to circumvent existing security restrictions

The vulnerability of the Mark of the Web operating system mechanism is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions remotely...