Search Results

123 results • Page 10 of 13

Metasploit Wrap-Up: 2/28/20 | Rapid7 Blog

... exploits CVE-2019-2215, which is a local privilege escalation vulnerability targeting Binder, the main ... a paired renderer exploit is required, because it is accessible through the sandbox.


Shoring Up the Defenses Together: 2018Q1 Wrap-Up | Rapid7 Blog

The Access-Control-Allow-Origin policy setting made it possible for an attacker in a man-in-the-middle (MITM ... Action, a malicious actor in a privileged network position could intercept the ...


Kubernetes Deployment From Runway To Takeoff | Rapid7 | Rapid7 Blog

... possible will ensure that you’re at least one step closer to a calmer deployment ... Ingress controllers for best practices Kubernetes API server access privileges Kubernetes operator best ...


Exposure Analysis of Unsupported (EOL) Windows Servers | Rapid7 Blog

This allowed for the elevation of privileges up to a domain admin level by exploiting a cryptographic weakness in the ... Remove public access to unsupported versions of Windows Server.


Cloud Pentesting, Pt. 2: Different Deployment Testing | Rapid7 Blog

... machine, which will then be allowed specific access inbound from a tester's IP ... Leveraging privileges and attempting to acquire data Adding user accounts or elevating privileges


Seeing The Whole Picture: A Better Way To Manage Your Attack Surface | Rapid7 Blog

... provide visibility into internal environments that are not publicly accessible. ... Access this hands-on, read-only experience of Surface Command to see how your team can accelerate high-risk ...


CVE-2023-49103: Critical Information Disclosure in ownCloud Graph API | Rapid7 Blog

... user, allowing an attacker to login to the affected ownCloud system with administrator privileges. ... GET request to a URI path containing the following in the Apache server’s access logs:


Cengage LTI Session Management Leakage | Rapid7 Blog

... wishing to impersonate an authenticated user would either need to have access to the browser session of the targeted user, or access to network proxy logs which can cache these tokens (thus, ...


PetitPotam Attack Chain Can Compromise Windows Domains Running AD CS | Rapid7 Blog

... the latest attack vector to underscore the fundamental fragility of the Active Directory privilege model. ... by adding the lsarpc named pipe to the server's allowlist for anonymous access.


CVE-2021-20025: SonicWall Email Security Appliance | Rapid7 Blog

... , static credential, which can be used by an attacker to gain root privileges on the device. ... Given remote root access to what is usually a perimeter-homed device, an attacker can further ...