The vulnerability of the Dr.Web Enterprise Security Suite, a antivirus software, allows a malicious individual to carry out XSS attacks.

The vulnerability of the Dr.Web Enterprise Security Suite anti-virus protection allows for XSS attacks due to insufficient validation of the user name in the web administrator’s login page. This means that before the user name is returned to the user, it may be compromised by a malicious actor...

WordPress Security Audit Log Plugin <= 2.4.3 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in the "/wp-security-audit-log.php" file. Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

Multiple vulnerabilities fixed in Aruba networks products

Multiple vulnerabilities have been discovered in various Aruba Networks products including Instant and ArubaOS access points, the Airwave management platform and the PAPI protocol that these systems mutually use. Some vulnerabilities have been fixed, others will be fixed in a future update, and f...

Oracle: Security Advisory (ELSA-2012-0997)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view

------------------------------------------------------------------------ Websense Email Security vulnerable to persistent Cross-Site Scripting in audit log details view ------------------------------------------------------------------------ Han Sahin, September 2014...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

SUSE-RU-2015:0393-1 Recommended update for SUSE Manager Server 2.1

This collective update for SUSE Manager Server 2.1 provides the following new features: ISS: export/import information about cloned channels to support Service Pack migration on ISS slaves. FATE317789 New API calls: system.scheduleSPMigration, system.scheduleDistUpgrade. FATE314785, FATE314340...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...

CVE-2014-0059

CVE-2014-0059 affects Red Hat JBoss EAP 6.x where JBoss SX and PicketBox leave audit.log world-readable. The issue enables local users to read sensitive data from the audit log (e.g., usernames/passwords). Red Hat addressed this in EAP 6.2.3 via RHSA-2014:0563/0564 updates; apply the JBoss EAP 6....

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Design/Logic Flaw

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

Default credentials

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified aka V7000U 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file...

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified (V7000U) 1.3.x and 1.4.x before 1.4.3.4 are affected by CVE-2014-3077, where the chkauth password is stored in the audit log. This enables a local attacker to read the log and obtain sensitive information. IBM security bulletins (CVE-2014-3077) ...