Ausnahme gefangen: SSL certificate problem: certificate is not yet valid 📌 U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure
Team IT Security Nachrichtenportal Logo

🏠 Team IT Security News

TSecurity.de ist eine Online-Plattform, die sich auf die Bereitstellung von Informationen,alle 15 Minuten neuste Nachrichten, Bildungsressourcen und Dienstleistungen rund um das Thema IT-Sicherheit spezialisiert hat.
Ob es sich um aktuelle Nachrichten, Fachartikel, Blogbeiträge, Webinare, Tutorials, oder Tipps & Tricks handelt, TSecurity.de bietet seinen Nutzern einen umfassenden Überblick über die wichtigsten Aspekte der IT-Sicherheit in einer sich ständig verändernden digitalen Welt.

16.12.2023 - TIP: Wer den Cookie Consent Banner akzeptiert, kann z.B. von Englisch nach Deutsch übersetzen, erst Englisch auswählen dann wieder Deutsch!

Google Android Playstore Download Button für Team IT Security
RSS Feed Symbol für Team IT Security 800+ IT News als RSS Feed abonnieren



📚 U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure


💡 Newskategorie: Sicherheitslücken
🔗 Quelle: vulners.com


image
hi team , i found that aem is running on████████ and CRXDE Lite/CRX is exposed to unauthenticated user that can lead to information disclosure POC 1-visit https://██████//██████████ 2-go to query and search for admin then execute 3-go to this endpoint to retrieve the information https://████████//████████/███ [+]Request ``` GET //███/███ HTTP/1.1 Host: ████ Connection: close sec-ch-ua: "Chromium";v="88", "Google Chrome";v="88", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.104 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate Accept-Language: en-US,en-XA;q=0.9,en;q=0.8 Cookie: oauth-configid=██████ [+]Response HTTP/1.1 200 OK Date: Thu, 04 Feb 2021 22:23:42 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Type: application/json;charset=utf-8 Content-Length: 1789 Connection: close Set-Cookie: ███████; path=/; Httponly; Secure Strict-Transport-Security: max-age=31536000; includeSubDomains Set-Cookie: f5avraaaaaaaaaaaaaaaa_session_=█████████; HttpOnly; secure Set-Cookie: █████████; Path=/ ████████ ``` █████████ Impact PII exposure System Host(s) ██████ Affected Product(s) and Version(s) CVE... ...



Sharing is caring on Social Media

🔗 Reddit
🔗 Telegram
🔗 LinkedIn
🔗 Xing
🔗 Twitter
🔗 Whatsapp
🔗 Facebook
🔗 Flipboard

Join the Team IT Security Community

🔗 "IT Sicherheit" Reddit-Gruppe
🔗 "IT Sicherheit" Telegramm-Seite

📌 U.S. Dept Of Defense: CRXDE Lite/CRX is on ██████ exposed that leads to PII disclosure


📈 142.41 Punkte

📌 CVE-2022-34184 | CRX Content Package Deployer Plugin up to 1.9 on Jenkins CRX Content Package Choice name/description cross site scripting


📈 59.75 Punkte

📌 U.S. Dept Of Defense: █████████ IDOR leads to disclosure of PHI/PII


📈 57.62 Punkte

📌 U.S. Dept Of Defense: [Partial] SSN & [PII] exposed through iPERMs Presentation Slide.


📈 49.02 Punkte

📌 U.S. Dept Of Defense: PII Leak of USCG Designated Examiner List at https://www.███


📈 41.03 Punkte

📌 U.S. Dept Of Defense: Bypassed a fix to gain access to PII of more than 100 Officers


📈 41.03 Punkte

📌 U.S. Dept Of Defense: ████████ portal is open to enumeration once authenticated. Session ID's appear static. All PII available once a valid session ID is found.


📈 41.03 Punkte

📌 U.S. Dept Of Defense: IDOR leaking PII data via VendorId parameter


📈 41.03 Punkte

📌 U.S. Dept Of Defense: CORS misconfiguration which leads to the disclosure


📈 40.72 Punkte

📌 U.S. Dept Of Defense: Authentication bypass leads to Information Disclosure at U.S Air Force "https://███"


📈 40.72 Punkte

📌 U.S. Dept Of Defense: AEM misconfiguration leads to Information disclosure


📈 40.72 Punkte

📌 U.S. Dept Of Defense: No Rate Limiting on https://██████/██████████/accounts/password/reset/ endpoint leads to Denial of Service


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Unrestricted file upload leads to stored xss on https://████████/


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Unrestricted File Upload Leads to XSS & Potential RCE


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Blind Stored XSS on ███████ leads to takeover admin account


📈 36.87 Punkte

📌 U.S. Dept Of Defense: IDOR leads to Leakage an ██████████ Login Information


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Self XSS + CSRF Leads to Reflected XSS in https://████/


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Password Reset link hijacking via Host Header Poisoning leads to account takeover


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Client side authentication leads to Auth Bypass


📈 36.87 Punkte

📌 U.S. Dept Of Defense: Path traversal leads to reading of local files on ███████ and ████


📈 36.87 Punkte

📌 U.S. Dept Of Defense: SSN is exposed on slides, previous critical report was not fixed in an appropriate way


📈 32.12 Punkte

📌 U.S. Dept Of Defense: Exposed Docker Registry at https://████


📈 32.12 Punkte

📌 U.S. Dept Of Defense: Apparent ██████████ website is publicly exposed, suggests default account details on page and has expired SSL/TLS cert


📈 32.12 Punkte

📌 U.S. Dept Of Defense: HAProxy stats panel exposed externally


📈 32.12 Punkte

📌 U.S. Dept Of Defense: DBMS information getting exposed publicly on -- [ ██████████ ]


📈 32.12 Punkte

📌 GNU Binutils config/tc-crx.c memory corruption


📈 29.88 Punkte

📌 CVE-2020-35534 | LibRaw cr3 File crx.cpp crxFreeSubbandData resource consumption (ID 279)


📈 29.88 Punkte

📌 CVE-2021-46897 | Wagtail CRX CodeRed Extensions up to 0.22.2 views.py path traversal (Issue 448)


📈 29.88 Punkte

📌 You’ll soon be able to install extensions in Edge mobile manually using CRX files


📈 29.88 Punkte

📌 U.S. Dept Of Defense: critical information disclosure


📈 27.99 Punkte

📌 U.S. Dept Of Defense: Tomcat examples available for public, Disclosure Apache Tomcat version, Critical/High/Medium CVE


📈 27.99 Punkte

📌 U.S. Dept Of Defense: critical information disclosure


📈 27.99 Punkte

📌 U.S. Dept Of Defense: [U.S. Air Force] Information disclosure due unauthenticated access to APIs and system browser functions


📈 27.99 Punkte

📌 U.S. Dept Of Defense: Splunk Sensitive Information Disclosure @████████


📈 27.99 Punkte

📌 U.S. Dept Of Defense: LDAP Server NULL Bind Connection Information Disclosure


📈 27.99 Punkte











matomo

Kontakt

24/7 kontakt@tsecurity.de

Weitere Informationen

Google Android Playstore Download Button für Team IT Security
🔗 Impressum
🔗 Datenschutz
Paypal Spenden für Projekt

Social Media

🔗 Facebook
🔗 Reddit
🔗 Team IT Security als Elektron App
🔗 © 2015-2023 Team IT Security Nachrichtenportal über Cybersecurity
🔗 CMS "myDraft" a PHP Portal Software