13 Cybersecurity Horror Stories to Give you Sleepless Nights

Are we sitting comfortably? Twas a dark and stormy night, and the cybersecurity team stood patiently in their Scrum meeting. “Tell us a tale,” the CISO said, and one of their number raised their hand. They caught the eye of their colleagues, and began… 1. An artists tale Curious reader, gird thy...

Microsoft Confirms Server Misconfiguration Led to 65,000+ Companies' Data Leak

Microsoft this week confirmed that it inadvertently exposed information related to thousands of customers following a security lapse that left an endpoint publicly accessible over the internet sans any authentication. "This misconfiguration resulted in the potential for unauthenticated access to...

PT-2022-12474 · Pascom +2 · Pascom Cloud Phone System +2

Name of the Vulnerable Software and Affected Versions: Pascom Cloud Phone System versions prior to 7.20.x Description: A configuration error between NGINX and a backend Tomcat server leads to a path traversal in the Tomcat server, exposing unintended endpoints. Recommendations: For versions prior...

CVE-2022-21236

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...

Information disclosure

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-21236

An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-21236

The CVE-2022-21236 issue affects Reolink RLC-410W (v3.0.0.136_20121102). A web server misconfiguration (nginx) exposes the TLS private key from the document root, enabling potential impersonation of the camera and, in some contexts, decryption of HTTPS traffic to steal an admin session token. Thi...

Hitachi Energy LinkOne 信息泄露漏洞

Hitachi Energy LinkOne is an enterprise graphical parts catalog and content delivery solution from Hitachi Energy, Switzerland. It is used to publish, view and locate spare parts for complex equipment and assemblies. A security vulnerability exists in Hitachi Energy LinkOne, which arises from a...

Hitachi Energy LinkOne 授权问题漏洞

Hitachi Energy LinkOne is an enterprise graphical parts catalog and content delivery solution from Hitachi Energy, Switzerland. It is used to publish, view and find spare parts for complex equipment and assemblies. A security vulnerability exists in Hitachi Energy LinkOne, which stems from a web...

Reolink Rlc-410W 信息泄露漏洞

Reolink Rlc-410W is a Wifi security camera from Reolink China. reolink RLC-410W in v3.0.0.13620121102 is vulnerable to information disclosure, which stems from information disclosure due to web server configuration errors. An attacker could use this vulnerability to obtain sensitive information...

Reolink RLC-410W web server misconfiguration information disclosure vulnerability

Summary An information disclosure vulnerability exists due to a web server misconfiguration in the reolink RLC-410W v3.0.0.13620121102. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability. Tested...

CVE-2021-44315

In Bus Pass Management System v1.0, Directory Listing/Browsing is enabled on the web server which allows an attacker to view the sensitive files of the application, for example: Any file which contains sensitive information of the user or server...

Dropbox: Send Fax from Anyone's HelloFax Account Due to Misconfigured Email Validation

The report demonstrates a method of using up HelloFax credits by forging email requests. A fix for the issue has been released and it was applied for existing and new users through an automatic update. An attacker could exploit this vulnerability by entering a victim’s HelloFax line number into a...

Flickr: critical server misconfiguration lead to access to any user sensitive data which include user email and password

Hi flickr team, I found a critical issue lead to access to any user sensitive data which include user hashed password and possibly can lead to takeover any user account on flickr's main site, literally i can get all user information from database with no restrictions , Let me explain how this...

Twitch Suffers Massive 125GB Data and Source Code Leak Due to Server Misconfiguration

Interactive livestreaming platform Twitch acknowledged a "breach" after an anonymous poster on the 4chan messaging board leaked its source code, an unreleased Steam competitor from Amazon Game Studios, details of creator payouts, proprietary software development kits, and other internal tools. Th...

CVE-2021-31410

Overly relaxed configuration of frontend resources server in Vaadin Designer versions 4.3.0 through 4.6.3 allows remote attackers to access project sources via crafted HTTP request...

CVE-2020-28396

A vulnerability has been identified in SICAM A8000 CP-8000 All versions V16, SICAM A8000 CP-8021 All versions V16, SICAM A8000 CP-8022 All versions V16. A web server misconfiguration of the affected device can cause insecure ciphers usage by a user´s browser. An attacker in a privileged position...

PT-2020-5606 · Siemens · Sicam A8000 Cp-8000 +2

Name of the Vulnerable Software and Affected Versions: SICAM A8000 CP-8000 versions prior to V16 SICAM A8000 CP-8021 versions prior to V16 SICAM A8000 CP-8022 versions prior to V16 Description: A web server misconfiguration in the affected devices can cause insecure ciphers usage by a user's...

Mail.ru: [api.33slona.ru] Доступ к API из за неправильной конфигурации сервера 302 редирет.

A 302 reply for non-authenticated request to api.33slona.ru could leak some static content with HTML body...

ALE Alcatel-Lucent Omnivista 4760 and ALE Alcatel-Lucent Omnivista 8770 Remote Code Execution Vulnerabilities

The ALE Alcatel-Lucent Omnivista 4760 and the ALE Alcatel-Lucent Omnivista 8770 are both products of ALE France.The ALE Alcatel-Lucent Omnivista 4760 is a network management system. The product includes alarm notification, OmniPCX configuration, performance analysis and Voice over IP monitoring.A...