Security Misconfiguration

Title	Vulnerabilities	Programs	Authors
Multiple vulnerabilities in UCOPIA <= 6.0.7 (CVE-2022-44719 / CVE-2022-44720)	Security Misconfiguration Local Privilege Escalation Internal Pentest	Weblib (Ucopia)	Jean Bonnevie Paul Barbé
Gaps in Azure Service Fabric’s Security Call for User Vigilance	Cloud Security Misconfiguration	Undisclosed	David Fiser
AWS Chain Attack- Thousands of Vulnerable EKS Clusters	AWS Kubernetes EKS Container Escape Security Misconfiguration	Undisclosed	Chen Shiri (@ChenShiri73)
How a misconfigured Lotus Domino Server can lead to Disclosure of PII Data of Employees, Configuration Details about the Active Directory, etc	Lotus Domino Security Misconfiguration Information Disclosure	Undisclosed	Aayush Vishnoi (@AayushVishnoi10)
Ghost Sites: Stealing Data From Deactivated Salesforce Communities	Salesforce Security Misconfiguration	Undisclosed	Nitay Bachrach
AEM Bug in Adobe	AEM Missing Authentication Security Misconfiguration	Adobe	Muhammad Mater (@Micro0x00)
A $1,000,000 bounty? The KuCoin User Information Leak	Information Disclosure Zendesk Broken Authorization Security Misconfiguration	Undisclosed	Corben Leo (@Hacker_)
No Portals Needed	2FA / MFA Bypass Security Misconfiguration	Undisclosed	Chen Levy Ben Aroy
Exploits Explained: Permission misconfiguration within Salesforce JavaScript Remoting tokens used for Apex Controllers	Salesforce Security Misconfiguration Broken Access Control	Undisclosed	Mahmoud Gamal (@Zombiehelp54)
How I got RCE in + 10 websites…	RCE Security Misconfiguration	Undisclosed	M4cddr (@M4cddr)
Microsoft Defender for Cloud Management Port Exposure Confusion	Cloud Security Misconfiguration	Microsoft	Aaron Sawitsky
Multiple vulnerabilities in Nokia BTS Airscale ASIKA	Base Transceiver Station Path Traversal Hardcoded Private Key Local Privilege Escalation Security Misconfiguration	Nokia	Geoffrey Bertoli (@YofBalibump) Lena David (@_Lemeda)
Hacking Apple: Two Successful Exploits and Positive Thoughts on their Bug Bounty Program	RCE Security Misconfiguration	Apple	Joe Gregg (@Infiltrateops) Mike Piekarski (@Pect0ral)
Hacking our way into internal DBs with hardcoded authentication keys	JWT SSO Authentication Bypass Security Misconfiguration	Undisclosed	Ophion Security (@OphionSecurity)
A-Salt: attacking SaltStack	SSTI Security Misconfiguration Information Disclosure RCE	Undisclosed	Alex Hill
How we made $120k bug bounty in a year with good automation	XSS Security Misconfiguration Log4shell Debug Mode Enabled	Undisclosed	Dawid Moczadło (@Kannthu1) Klaudia Kloc
Azure security — Internal recon leveraging lack of access control	Azure AD Cloud Security Misconfiguration Privilege Escalation	Microsoft (Azure)	Molx32
API Misconfiguration - No Swag of SwaggerUI	Security Misconfiguration Privilege Escalation	Undisclosed	Jerry Shah (@Jerry)
Firebase Exploit bug bounty	Security Misconfiguration Firebase	Undisclosed	Damaidec
Dodging OAuth origin restrictions for Firebase spelunking	OAuth Security Misconfiguration Broken Authentication	Undisclosed	Aditya Saligrama (@Saligrama_a) Glen Husman
Header spoofing via a hidden parameter in Facebook Batch GraphQL APIs	GraphQL Security Misconfiguration	Meta / Facebook	David Schütz (@Xdavidhu)
System misconfiguration is the number one vulnerability, at least for Mastodon	Security Misconfiguration MinIO Misconfiguration	Infosec.exchange	Lenin Alevski (@Alevsk)
The Danger of Falling to System Role in AWS SDK Client	Cloud Privilege Escalation Security Misconfiguration	Undisclosed	Fracensco Lacerenza (@Lacerenza_fra) Mohamed Ouad (@Ouadmoha)
Complete take-over of Cisco Unified Communications Manager due consecutively misconfigurations	Security Misconfiguration VoIP Hacking	Undisclosed	Hackthebox
NotLegit: Azure App Service vulnerability exposed hundreds of source code repositories	Security Misconfiguration .Git Folder Disclosure	Microsoft	Wiz (@Wiz_io)

Page 1 of 2