CVE-2019-6158

The CVE-2019-6158 case affects Lenovo XClarity Administrator (LXCA). Concrete details in the connected sources show that HTTP proxy credentials were written to a log file in clear text, impacting LXCA versions 2.0.0 to 2.3.x when proxy credentials are configured. The practical impact is informati...

XClarity Administrator (LXCA) Service Data May Include Proxy Credentials - Lenovo Support US

No description provided...

Information Disclosure

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way 389 Directory Server handled password changes. If an LDAP user has changed thei...

Vulnerability of the Server component: The Audit Plug-in of the MySQL database management system, which allows a hacker to cause a service failure.

The vulnerability of the Server component: The Audit Plug-in of the MySQL database management system is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the MySQL protocol...

UBUNTU-CVE-2019-2566

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Plug-in. Supported versions that are affected are 5.7.25 and prior and 8.0.15 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromis...

. NET advanced code audit, the eleventh classes LosFormatter to deserialize vulnerability-vulnerability warning-the black bar safety net

LosFormatter is generally used to serialize and deserialize the Web form page's view statethe ViewState, if you want to put the ViewState through a database or other persistence devices to maintain, it requires the use of specific LosFormatter class to serialize/deserialized. It is encapsulated i...

. NET advanced code audit of the first ten classes ObjectStateFormatter deserialize vulnerability-vulnerability warning-the black bar safety net

0x00 Preface ObjectStateFormatter generally used for serialization and deserialization of the state object graph, such as the commonly used ViewState is through this class to do the serialization, is located in the namespace System. Web. The UI, the advantage is that on the basis of the type stor...

Oracle MySQL Server Access Control Error Vulnerability (CNVD-2019-16278)

Oracle MySQL is an open source relational database management system from Oracle Corporation, of which MySQL Server is a database server component. A security vulnerability exists in the MySQL Server component of Oracle MySQL, version 5.7.25 and earlier, and the Server: Audit Plug-in subcomponent...

UPDATE: Sysdig Falco v0.14.0

PenTestIT RSS Feed Recently, an updated version - Sysdig Falco v0.14.0 - was released. It has been some time since I last blogged about this open source behavorial activity monitor which has container support. What is Sysdig Falco? Sysdig Falco is an open source, behavioral activity monitor...

. NET advanced code audit, the eighth classes SoapFormatter deserialization vulnerability-vulnerability warning-the black bar safety net

SoapFormatter formatter and the next lesson introduce the BinaryFormatter formatter are. NET internal implementation of a serialization function classes, SoapFormatter derived directly from the System. The Object, located in the namespace System. Runtime. Serialization. Formatters. Soap, and...

CloudBees Jenkins Audit to Database plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Audit to Database Plugin is used in which a...

. NET advanced code audit of the seven classes NetDataContractSerializer deserializing vulnerability-vulnerability warning-the black bar safety net

NetDataContractSerializer and DataContractSerializer for serialization and de-serialization in Windows Communication Foundation WCF message to send the data. Between the two there is an important difference: the NetDataContractSerializer includes CLR through the CLR type to add additional...

CVE-2019-1003077

A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003077

A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003075

Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

CVE-2019-1003076

A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server...

Design/Logic Flaw

Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

Input validation

A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers with Overall/Read permission to initiate a connection to an attacker-specified server...

CVE-2019-1003077

The CVE-2019-1003077 issue concerns Jenkins Audit to Database Plugin. A missing permission check in DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation allows users with Overall/Read permission to trigger a connection to an attacker-controlled server. Connected sources (including ...

CVE-2019-1003076

A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpldoTestJdbcConnection form validation method allows attackers to initiate a connection to an attacker-specified server...