CVE-2017-18748

CVE-2017-18748 affects NETGEAR router models EX6200v2, R6100, R7500, R7500v2, R7800, R9000, WNDR4300v2, and WNDR4500v3 due to incorrect configuration of security settings. Vulnerable components/functional areas are the devices’ security configuration, with the root cause described as misconfigura...

Design/Logic Flaw

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects D3600 before 1.0.0.76 and D6000 before 1.0.0.76...

CVE-2017-18798

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, D7000 before 1.0.1.50, and D1500 before 1.0.0.25...

CVE-2017-18798

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects R6700v2 before 1.1.0.38, R6800 before 1.1.0.38, D7000 before 1.0.1.50, and D1500 before 1.0.0.25...

CVE-2017-18808

NETGEAR ReadyNAS OS 6 devices running ReadyNAS OS versions prior to 6.8.0 are affected by incorrect configuration of security settings...

CVE-2019-20693

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC505 before 8.0.6.4 and WAC510 before 8.0.6.4...

CVE-2019-20654

Certain NETGEAR devices are affected by incorrect configuration of security settings. This affects WAC505 before 8.0.6.4 and WAC510 before 8.0.6.4...

Audix - A PowerShell Tool To Quickly Configure The Windows Event Audit Policies For Security Monitoring

Audix will allow for the SIMPLE configuration of Windows Event Audit Policies. Window's Audit Policies are restricted by default. This means that for Incident Responders, Blue Teamers, CISO's & people looking to monitor their environment through use of Windows Event Logs, must configure the audit...

CVE-2020-1938

When using the Apache JServ Protocol AJP, care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that...

CVE-2020-5231

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

CVE-2020-5231

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

Default configuration

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

Unauthenticated Access Via OAI-PMH

Impact Media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public...

Hard-Coded Key Used For Remember-me Token in Opencast

Impact The security configuration in etc/security/mhdefaultorg.xml enables a remember-me cookie based on a hash created from the username, password, and an additional system key. Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring th...

Users with ROLE_COURSE_ADMIN can create new users in Opencast

Impact Users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. For example: bash Use the admin to create a new user with ROLECOURSEADMIN using the admin user. We expect this to work. % curl -i -u admin:opencast...

GHSA-94QW-R73X-J7HG Users with ROLE_COURSE_ADMIN can create new users in Opencast

Impact Users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. For example: bash Use the admin to create a new user with ROLECOURSEADMIN using the admin user. We expect this to work. % curl -i -u admin:opencast...

CVE-2020-5231

Opencast is affected in versions before 7.6 and before 8.1 where users with the non‑standard ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users (not granting ROLE_ADMIN). Root cause: a misconfiguration in security allowing creation by a course admin. Impact: authorization bypas...

CVE-2020-5231 Opencast users with ROLE_COURSE_ADMIN can create new users

In Opencast before 7.6 and 8.1, users with the role ROLECOURSEADMIN can use the user-utils endpoint to create new users not including the role ROLEADMIN. ROLECOURSEADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code except for tests but only i...

PT-2020-11251 · Wowza · Wowza Streaming Engine

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions 4.8.0 and earlier Wowza Streaming Engine versions 4.7.7 and 4.7.8 Description: The issue arises from multiple authenticated XSS vulnerabilities. These can be exploited via the customList%5B0%5D.value field in...

Automating API Security in the Cloud

These days, the most common way for services to communicate and transfer data is by using APIs. However, broken, exposed, or hacked APIs are the cause of some of the latest major data breaches, as they have the potential to expose sensitive data for public consumption. Securing your APIs is...