CVE-2021-33689

When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...

Nextcloud: No admin audit log for auth tokens

There seems to be no audit trail for auth tokens. Creating tokens Revoking tokens Scope changes Renames Marking the token to be wiped Impact As auth tokens are used to access your data having a track record when they are created helps a lot. If you also take https://hackerone.com/reports/1193321...

Nextcloud: No admin audit entry for enabling/disabling 2FA

Related to https://hackerone.com/reports/1177353 When a user enables or disables 2FA there is no entry in the audit log. Impact Especially for disabling it should probably be logged there. But account security related things should be in there...

Nextcloud: Federated share accepting/declining is not logged in audit log

In relation to https://hackerone.com/reports/1177353 1. Enable the audit log 2. Share a file to a federated user 3. So far all looks good in the log 4. the recipient checks either accepts or declines the share 5. There is no line regarding this in the logs. Impact The audit log is used to get a...

CVE-2021-31906

CVE-2021-31906 affects JetBrains TeamCity prior to 2020.2.2. The issue is that audit logs were not sufficient when an administrator uploaded a file, leading to potential information disclosure implied by insufficient logging. Exploitation details are not provided in the supplied documents, and th...

Audit Log Request Bypass

HashiCorp Consul Enterprise is bypassing audit-logging request. It is possible because it does not parse endpoint URL to prevent requests from bypassing the audit log...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

Design/Logic Flaw

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

UBUNTU-CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

CVE-2021-28156 affects HashiCorp Consul Enterprise: versions 1.8.0 through 1.9.4 are vulnerable where the audit log can be bypassed via specifically crafted HTTP events. The issue is fixed in 1.9.5 and in 1.8.10. Connected documents confirm the vulnerability details and the fixed versions; no exp...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

CVE-2021-28156

HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...

PT-2021-17780 · Hashicorp +1 · Hashicorp Consul Enterprise +1

Name of the Vulnerable Software and Affected Versions: HashiCorp Consul Enterprise versions 1.8.0 through 1.9.4 Description: The issue allows the audit log to be bypassed by specifically crafted HTTP events. Recommendations: For versions 1.8.0 through 1.8.9, update to version 1.8.10. For versions...

Consul Enterprise Audit Log Bypass for HTTP Events

Summary A vulnerability was identified in Consul Enterprise such that a specially crafted HTTP request can be used to bypass the audit log for HTTP events. This vulnerability, CVE-2021-28156, affects Consul Enterprise versions 1.8.0 up to 1.9.4, and is fixed in the 1.9.5 and 1.8.10 releases...

CVE-2021-28156

A flaw was found in the hashicorp consul, where the audit log could be bypassed. The highest threat from this vulnerability is to integrity...

Consul -- Multiple vulnerabilities

Hashicorp reports: Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864. audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log CVE-2021-28156...