this post was submitted on 29 Nov 2023
0 points (50.0% liked)

Self-Hosted Main

511 readers
1 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

For Example

We welcome posts that include suggestions for good self-hosted alternatives to popular online services, how they are better, or how they give back control of your data. Also include hints and tips for less technical readers.

Useful Lists

founded 1 year ago
MODERATORS
[email protected]
0
ownCloud vulnerability with maximum 10 severity score under “mass” exploitation (alien.top)
submitted 11 months ago by [email protected] to c/[email protected]
24 comments fedilink hide all child comments
 

ownCloud vulnerability with maximum 10 severity score comes under “mass” exploitation | Ars Technica

"The vulnerability, which carries the maximum severity rating of 10, makes it possible to obtain passwords and cryptographic keys allowing administrative control of a vulnerable server by sending a simple Web request to a static URL"

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 2 points 11 months ago

Honestly, all applications are vulnerable AF, especially the open source projects without a major team behind them. I work in a security research team and we find critical bugs like this in a weekly basis. Even in major projects which you would be scared to know about. I personally wouldn’t expose anything except SSH or a VPN, or if I have to expose a web app, it’s going inside a VLAN with very restrictive firewall rules, proper logging, and a reverse proxy enforcing authentication via an OIDC based IDP.

We generally spend a couple of days to a week before finding something critical allowing RCE.