Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-2712PUBLISHED: 2023-01-27
In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path starting with './'. Successful exploitation could allow an remote unauthenticated attacker to access critical data, such as configuration files and deployed appli...
CVE-2020-36659PUBLISHED: 2023-01-27
In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 ...
CVE-2020-36658PUBLISHED: 2023-01-27In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
CVE-2023-24060PUBLISHED: 2023-01-27
Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage b...
CVE-2023-22740PUBLISHED: 2023-01-27
Discourse is an open source platform for community discussion. Versions prior to 3.1.0.beta1 (beta) (tests-passed) are vulnerable to Allocation of Resources Without Limits. Users can create chat drafts of an unlimited length, which can cause a denial of service by generating an excessive load on the...
User Rank: Strategist
12/22/2014 | 9:42:46 AM
Maybe I'm misinterpretting the author's intent, but it doesn't just seem to be the author of this particular article. A great number of tech-news sites are covering this so-called issue this morning, and all of them are reporting essentially the same thing, that this is some sort of flaw. A misconfigured service is not a flaw, but rather a poorly thought-out security measure, and as is well known, there is no patch for human-stupidity. Either the sysadmin is competant or not. There is no half-way or grey-area where that is concerned. Either you know what you're doing or you don't, which *is* correctable provided the person on the receiving end of new training is competant enough to understand their training... otherwise, they're in the wrong line of work.