CVE-2016-0231

IBM CVE-2016-0231 affects IBM FTM for ACH Services, Check Services and CPS (3.0.0) prior to FP12, where an authenticated user could obtain sensitive information by reading exception details in error logs. The issue is documented across IBM advisories for FTM components and is also reflected in CN...

IBM Tivoli Security Directory Server Information Disclosure Vulnerability (CNVD-2015-04103)

IBM Tivoli Security Directory Server now known as IBM Security Directory Server, ISDS is a suite of enterprise identity management software from IBM in the United States that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for...

Enter: Server responds with the server error logs on account creation

Impact Poorly protected response can provide a gold mine of information to an attacker, disclosing a host of sensitive information such as function and file names. This information may enable the attacker to immediately or later compromise the entire application. PoC 1. Create a new wallet. 2...

OpenJDK: insecure hsperfdata temporary file handling (Hotspot, 8050807)

Multiple insecure temporary file use issues were found in the way the Hotspot component in OpenJDK created performance statistics and error log files. A local attacker could possibly make a victim using OpenJDK overwrite arbitrary files using a symlink attack...

[SECURITY] Fedora 21 Update: sysklogd-1.5-18.fc21

The sysklogd package contains two system utilities syslogd and klogd which provide support for system logging. Syslogd and klogd run as daemons background processes and log system messages to different places, like sendmail logs, security logs, error logs, etc...

[SECURITY] Fedora 20 Update: sysklogd-1.5-18.fc20

The sysklogd package contains two system utilities syslogd and klogd which provide support for system logging. Syslogd and klogd run as daemons background processes and log system messages to different places, like sendmail logs, security logs, error logs, etc...

Patch for Security advisory 2014-05-21 doesn't work in Confluence 3.5.X

h3. Steps to reproduce: Confluence 3.5.13 Installed, booted up Postregres DB Shutdown, applied patch following advisory admin panel not accessible content appears to be missing see errors in the logs: code 2014-05-22 16:28:50,308 ERROR http-8080-1 Standalone.localhost./.action log Servlet.service...

JVN#61077110: EC-CUBE vulnerable to information disclosure

EC-CUBE from LOCKON CO.,LTD. is an open source system for creating shopping websites. EC-CUBE contains a vulnerability in processing the output of error logs, which may lead to information disclosure. Impact A user who visits the shopping site may view the information managed by the website owner...

SynConnect Pms - index.php?loginid SQL Injection

SynConnect Pms - index.php?loginid SQL Injection Title: ==== SynConnect - SQL Injection vulnerability Credit: ====== Name: Bhadresh Patel Company/affiliation: Cyberoam Technologies Private Limited Website: www.cyberoam.com CVE: ===== Date: ==== 01-03-2013 CRD: ==== CRD-2013-01 Vendor: ======...

No title provided

store/swift.py in OpenStack Glance Essex 2012.1, Folsom 2012.2 before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive...

ME Monitoring Manager Cross Site Scripting / SQL Injection

Title: ====== ME Monitoring Manager v9.x; v10.x - Multiple Vulnerabilities Date: ===== 2012-01-27 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=115 VL-ID: ===== 115 Introduction: ============= Mit dem ManageEngine Applications Manager können IT-Administratoren von...

vBulletin v4.1.10 - Path Information Disclosure

Document Title: =============== vBulletin v4.1.10 - Path Information Disclosure References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=387 Release Date: ============= 2012-01-15 Vulnerability Laboratory ID VL-ID: ==================================== 387 Product...

Facebook JuniorsCheesecakeFoxwoods - SQL Vulnerability

Document Title: =============== Facebook JuniorsCheesecakeFoxwoods - SQL Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=338 Release Date: ============= 2011-12-20 Vulnerability Laboratory ID VL-ID: ==================================== 338...

Facebook New Year Scraps - SQL Injection Vulnerability

Document Title: =============== Facebook New Year Scraps - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=274 Release Date: ============= 2011-10-27 Vulnerability Laboratory ID VL-ID: ==================================== 274...

CVE-2009-2977

The Cisco Security Monitoring, Analysis and Response System CS-MARS 6.0.4 and earlier stores cleartext passwords in log/sysbacktrace. files within error-logs.tar.gz archives, which allows context-dependent attackers to obtain sensitive information by reading these files...

CmsFaethon 2.2.0 - 'item' SQL Injection

!/usr/bin/perl |----------------------------------------------------------------------------------------------------------------------------------| | INFORMATIONS | |----------------------------------------------------------------------------------------------------------------------------------|...

EntertainmentScript 1.4.0 - 'page.php' Local File Inclusion

!/usr/bin/perl EntertainmentScript V1.4.0 page.php page Local File Inclusion Exploit Founded & Exploited by : Stack-Terrorist v40 Contact: Ev!L = see down Greetz : Houssamix & Djekmani & Jadi & iuoisn & All muslims HaCkeRs : P0c : http://localhost.il/page.php?page=../../../../../etc/passwd%00...

Code injection

Cisco Network Admission Control NAC Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attackers to obtain the shared secret for the Clean Access Server CAS and Clean Access Manager CAM by sniffing error logs...

CVE-2008-1155

Cisco Network Admission Control NAC Appliance 3.5.x, 3.6.x before 3.6.4.4, 4.0.x before 4.0.6, and 4.1.x before 4.1.2 allows remote attackers to obtain the shared secret for the Clean Access Server CAS and Clean Access Manager CAM by sniffing error logs...

CVE-2008-1155

Cisco NAC Appliance is vulnerable to an information-disclosure flaw that lets remote attackers obtain the shared secret used by CAS/CAM by sniffing error-logs transmitted over the network. Affected: NAC Appliance versions 3.5.x; 3.6.x prior to 3.6.4.4; 4.0.x prior to 4.0.6; 4.1.x prior to 4.1.2. ...