5236 matches found
Security Risks of Relying on a Single Smartphone
Isracard used a single cell phone to communicate with credit card clients, and receive documents via WhatsApp. An employee stole the phone. He reformatted the phone and replaced the SIM card, which was oddly the best possible outcome, given the circumstances. Using the data to steal money would...
Eigen NLP 安全漏洞
Eigen NLP is a natural language processing system. Eigen NLP suffers from a security vulnerability that stems from the lack of access control to auth v1 sso config, where the sso config endpoint allows any logged in user guest, standard, or admin to view and modify information...
in apolloconfig/apollo
✍️ Description The Application does not have control set in password complexity. It is possible to add a user with a single character password in the application. 🕵️♂️ Proof of Concept Adding the user. POST /users HTTP/1.1 Host: xxx.xxx.xxx.xxx Content-Length: 63 Accept: application/json,...
Exploit for Expression Language Injection in Atlassian Confluence_Data_Center
CVE-2021-26084 Proof of concept for CVE-2021-26084. Confluen...
Security Bulletin: Vulnerability in Apache Tomcat affects IBM Platform Symphony
Summary This interim fix provides instructions on upgrading Apache Tomcat from v5.5.36 to v7.0.90 in IBM Platform Symphony 6.1.1 and from v6.0.43 to v8.5.32 in IBM Platform Symphony 7.1 Fix Pack 1 in order to address security vulnerability CVE-2018-8014 in Tomcat. Vulnerability Details CVE-ID:...
CISA Adds Single-Factor Authentication to the List of Bad Practices
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added single-factor authentication to the short list of "exceptionally risky" cybersecurity practices that could expose critical infrastructure as well as government and the private sector entities to devastating cyberattack...
CVE-2021-38385
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007...
CISA Adds Single-Factor Authentication to list of Bad Practices
Today, CISA added the use of single-factor authentication for remote or administrative access systems to our Bad Practices list of exceptionally risky cybersecurity practices. Single-factor authentication is a common low-security method of authentication. It only requires matching one factor—such...
Zoho ManageEngine ADSelfService Plus 跨站脚本漏洞
Zoho ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlocking, profile information update, etc. without relying on the help desk. A reflected cross-site scripting vulnerability exists in the...
CVE-2021-38385
Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification, leading to a remote assertion failure, aka TROVE-2021-007...
Johnson Controls Controlled Electronic Management Systems CEM Systems AC2000
1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: Controlled Electronic Management Systems Ltd., a subsidiary of Johnson Controls Inc Equipment: CEM Systems AC2000 Vulnerability: Improper Authorization 2. RISK EVALUATION Under specific conditions,...
openSUSE 15 Security Update : tor (openSUSE-SU-2021:1169-1)
The remote SUSE Linux SUSE15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE-SU-2021:1169-1 advisory. - Tor before 0.3.5.16, 0.4.5.10, and 0.4.6.7 mishandles the relationship between batch-signature verification and single-signature verification,...
Exploit for OS Command Injection in Fortinet Fortiweb
CVE-2021-22123 Fortinet FortiWeb Authenticated OS Command Inje...
PT-2021-22099 · Tor +4 · Tor +4
Name of the Vulnerable Software and Affected Versions: Tor versions prior to 0.3.5.16 Tor versions prior to 0.4.5.10 Tor versions prior to 0.4.6.7 Description: The issue is related to how Tor handles the relationship between batch-signature verification and single-signature verification, leading ...
In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8 there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.
...
CVE-2020-18449
Cross Site Scripting XSS vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php...
Single-step process for critical admin transfer is risky
Handle 0xRajeev Vulnerability details Impact LongShort and Staker contracts have the notion of an “admin” address that is used within onlyAdmin or adminOnly modifiers for granting authorization to critical functions. Such contracts use a single-step ownership transfer of such admin addresses usin...
CVE-2021-22240
Improper access control in GitLab EE versions 13.11.6, 13.12.6, and 14.0.2 allows users to be created via single sign on despite user cap being enabled...
