904 matches found
CVE-2021-33689
When user with insufficient privileges tries to access any application in SAP NetWeaver Administrator Administrator applications, version - 7.50, no security audit log is created. Therefore, security audit log Integrity is impacted...
CVE-2021-33689
SAP NetWeaver AS Java 7.50 Administrator applications are affected by CVE-2021-33689: insufficient logging for users with limited privileges that access any Administrator app, impacting audit log integrity. The issue is documented across multiple feeds (NVD/Red Hat/Nessus) with low–medium severit...
Nextcloud: No admin audit log for auth tokens
There seems to be no audit trail for auth tokens. Creating tokens Revoking tokens Scope changes Renames Marking the token to be wiped Impact As auth tokens are used to access your data having a track record when they are created helps a lot. If you also take https://hackerone.com/reports/1193321...
Nextcloud: No admin audit entry for enabling/disabling 2FA
Related to https://hackerone.com/reports/1177353 When a user enables or disables 2FA there is no entry in the audit log. Impact Especially for disabling it should probably be logged there. But account security related things should be in there...
Nextcloud: Federated share accepting/declining is not logged in audit log
In relation to https://hackerone.com/reports/1177353 1. Enable the audit log 2. Share a file to a federated user 3. So far all looks good in the log 4. the recipient checks either accepts or declines the share 5. There is no line regarding this in the logs. Impact The audit log is used to get a...
CVE-2021-31906
CVE-2021-31906 affects JetBrains TeamCity prior to 2020.2.2. The issue is that audit logs were not sufficient when an administrator uploaded a file, leading to potential information disclosure implied by insufficient logging. Exploitation details are not provided in the supplied documents, and th...
Audit Log Request Bypass
HashiCorp Consul Enterprise is bypassing audit-logging request. It is possible because it does not parse endpoint URL to prevent requests from bypassing the audit log...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
Design/Logic Flaw
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
UBUNTU-CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
CVE-2021-28156
CVE-2021-28156 affects HashiCorp Consul Enterprise: versions 1.8.0 through 1.9.4 are vulnerable where the audit log can be bypassed via specifically crafted HTTP events. The issue is fixed in 1.9.5 and in 1.8.10. Connected documents confirm the vulnerability details and the fixed versions; no exp...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
CVE-2021-28156
Removed by vendor...
CVE-2021-28156
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10...
PT-2021-17780 · Hashicorp +1 · Hashicorp Consul Enterprise +1
Name of the Vulnerable Software and Affected Versions: HashiCorp Consul Enterprise versions 1.8.0 through 1.9.4 Description: The issue allows the audit log to be bypassed by specifically crafted HTTP events. Recommendations: For versions 1.8.0 through 1.8.9, update to version 1.8.10. For versions...
Consul Enterprise Audit Log Bypass for HTTP Events
Summary A vulnerability was identified in Consul Enterprise such that a specially crafted HTTP request can be used to bypass the audit log for HTTP events. This vulnerability, CVE-2021-28156, affects Consul Enterprise versions 1.8.0 up to 1.9.4, and is fixed in the 1.9.5 and 1.8.10 releases...
