Sealighter - Easy ETW Tracing for Security Research

I created this project to help non-developers dive into researching Event Tracing for Windows ETW and Windows PreProcessor Tracing WPP. Features Subscribe to multiple ETW and WPP Providers at once Automatically parse events into JSON without needing to know format Robust Event filtering including...

SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log

Persistence by writing/reading shellcode from Event Log. Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management Service". The shellcode is converted to hex and written to the "Key Manageme...

CVE-2021-4211

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4211

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4211

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

CVE-2021-4211: Improper Input Validation

A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code...

GSD-2022-1000775 iommu/amd: Recover from event log overflow

iommu/amd: Recover from event log overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.27 by commit...

GSD-2022-1000707 iommu/amd: Recover from event log overflow

iommu/amd: Recover from event log overflow This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.16.13 by commit...

CVE-2022-25248

When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions supplies the event log of the specific service...

CVE-2022-25248

When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions supplies the event log of the specific service...

Code injection

When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions supplies the event log of the specific service...

CVE-2022-25248

CVE-2022-25248 and related Axeda vulnerabilities affect the PTC Axeda agent and Axeda Desktop Server (Windows) across all versions prior to 6.9.3. The issues include hard-coded credentials (CVE-2022-25246), missing authentication for critical functions (CVE-2022-25247, CVE-2022-25251), exposure o...

CVE-2022-25248 PTC Axeda agent and Axeda Desktop Server Information Exposure

When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions supplies the event log of the specific service...

Phant0m - Windows Event Log Killer

Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concer...

CVE-2021-41808

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...

Default credentials

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...

CVE-2021-41808

In M-Files Server, versions prior to 21.11.10775.0 are affected by a logging-related issue where enabling Federated authentication logging to the Windows event log could expose sensitive information. The mitigating factor is that logging is disabled by default, reducing practical exposure. The co...

CVE-2021-41808

In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...

PT-2022-11488

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 21.11.10775.0 Description The issue concerns the logging of Federated authentication to the event log in the M-Files Server product, where sensitive information is written to the log when this feature is enable...

M-Files Server 日志信息泄露漏洞

M-Files Server is a server for the M-Files system from M-Files, Inc. A security vulnerability exists in versions of the M-Files Server product prior to 21.11.10775.0 that stems from logging with federated authentication enabled writing sensitive information to the event log...