6431 matches found
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
Design/Logic Flaw
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
CVE-2020-12078
CVE-2020-12078 - Open-AudIT 3.3.1 : A shell metacharacter injection flaw exists in the open-audit/configuration/ URI. The exclude_ip value from global discovery settings is passed to an unfiltered exec in discoveries_helper.php (inside all_ip_list), allowing a payload to execute commands. Connect...
CVE-2020-12078
An issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker can exploit this by adding an excluded IP address to the global discovery settings internally called excludeip. This excludeip value is passed to the...
Opmantek Open-AudIT Operating System Command Injection Vulnerability
Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek USA. The program intelligently scans networks and network devices and provides status reports. Opmantek Open-AudIT suffers from an operating system command injection vulnerability that stems from the...
Command Execution Vulnerability in Panalog Log Audit System of Beijing Paiwang Software Co.
Panabit log auditing system supports clustering and open Raw Data interface to Hadoop big data platform. And embedded in the cloud control platform, convenient for users to unify and centralized monitoring and so on. Panabit Log Audit System has a command execution vulnerability that can be...
CVE-2020-11941
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery...
CVE-2020-11941
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery...
Command injection
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery...
CVE-2020-11941
Open-AudIT 3.2.2 contains multiple vulnerabilities. An authenticated attacker can exploit OS command injection in the Discovery module by unsafely handling data[attributes][other][nmap][ssh_ports], enabling remote code execution (reverse shell) on the appliance, as demonstrated in the Core Securi...
CVE-2020-11941
An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery...
Open-AudIT Multiple Vulnerabilities
Advisory ID Internal CORE-2020-0009 1. Advisory Information Title: Open-AudIT Multiple Vulnerabilities Advisory ID: CORE-2020-0009 Advisory URL: https://www.coresecurity.com/advisories/open-audit-multiple-vulnerabilities Date published: 2020-04-27 Date of last update: 2020-04-24 Vendors...
Open-AudIT 3.3.0 Cross Site Scripting
Exploit Title: Open-AudIT 3.3.0 - Authenticated XSS Attacks Date: 26-04-2020 Exploit Author: Kamaljeet Kumar Vendor Homepage: https://opmantek.com/network-discovery-inventory-software/ Software Link: https://www.open-audit.org/downloads.php Version: 3.3.0 CVE : CVE-2020-12261 POC: Step 1: Login t...
RUSTSEC-2020-0014 Various memory safety issues
Several memory safety issues have been uncovered in an audit of rusqlite. See https://github.com/rusqlite/rusqlite/releases/tag/0.23.0 for a complete list...
Various memory safety issues
Several memory safety issues have been uncovered in an audit of rusqlite. See https://github.com/rusqlite/rusqlite/releases/tag/0.23.0 for a complete list...
Trend Micro Integrates with Amazon AppFlow
The acceleration of in-house development enabled by public cloud and Software-as-a-Service SaaS platform adoption in the last few years has given us new levels of visibility and access to data. Putting all of that data together to generate insights and action, however, can substitute one challeng...
MITRE ATT&CK APT 29 evaluation proves Microsoft Threat Protection provides deeper end to end view of advanced threats
As attackers use more advanced techniques, it’s even more important that defenders have visibility not just into each of the domains in their environment, but also across them to piece together coordinated, targeted, and advanced attacks. This level of visibility will allow us to get ahead of...
Cross-site Scripting (XSS)
dolibarr is vulnerable to cross-site scripting XSS. With the USERLOGINFAILED setting,an attacker can inject arbitrary script in admin tools -- audit page, possibly stealing admin account...
