Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Microsoft Malware Protection Engine RCE (CVE-2017-0290)

Natalie Silvanovich and Tavis Ormandy of Google Project Zero found a pretty nasty bug in Microsoft Malware Protection Engine, allowing an attacker to execute arbitrary code as LocalSystem on any Windows computer running any Microsoft anti-malware product such as Security Essentials or Windows...

Citrix Director: Could Not Establish Trust Relationship for the SSL/TLS Secure Channel

Director display in License Server section Cannot retrieve the data. Data source unresponsive due to configuration error. View Director server event logs for further information Checking the Application event log on the server running Director- logs event error: Event ID: 8 Level: Error Source:...

PVS Servers randomly became offline

PVS servers were randomly offline and then recover automatically. The issue could happen several times a day on different PVS server. When PVS server was offline, sometimes we saw Streamprocess event 11 logged in event log, but sometime not...

'Events data collection failure' Issue

Challenge Veeam ONE raises Events data collection failure against Veeam Backup & Replication or Hyper-V server. Cause Permissions, UAC configuration, and firewall settings need to be configured. Solution Troubleshooting Checks Verify that the account used to connect to Veeam Backup & Replication ...

Bnistack error 85 - IOS Socket UNAVAILABLE - not counting retry

Target Devices actively connected to Provisioning Services suddenly exhibit severe performance issues such as: Target completely hangs Performance is extremely slow Number of retries increases dramatically Atthe same time the following error is found in the Event Logs inside the Target Device:...

PVS Targets run chkdsk at boot after the vDisk has been modified

Every time a PVS Target Device boots from a vDisk the OS detects problems with the C: drive and automatically runs chkdsk at boot time. The following events might be observed in the Windows Event Log on the Target Device: Event Log: System Source: Ntfs Event ID: 55 Text: The file system structure...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure Vunerability

Farmer's Fridge Kiosk version 2.0.0 suffers from an unprotected event log information disclosure vulnerability as well as unauthenticated request issues. Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure

Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com Affected version: 2.0.0 Summary: Donat think of the Farmeras Fridge kiosk as a vending machine. Itas a veggie machine. And just as each salad is a culina...

Unifiltr EventID 3: Unidesk denied an attempt to rename a directory

Your software may report an error attempting to rename a directory, you may receive an error trying to move a folder to the Recycle Bin, and you may see an error in the Windows System event log on an IM that looks like this: Log Name: System Source: unifltr Date: 10/23/2013 9:58:30 PM Event ID: 3...

StoreFront SAML Troubleshooting Guide

During the installation and configuration of the SAML functionality introduced with StoreFront 3.9, there are various items to be aware of when performing a successful configuration. Although there are other issues you might encounter, this document will try to provide direction to help resolve...

Overview of Windows activation with KMS server

Sometimes after properly following the preparation steps, on start up the Operating System shows only 3 days remaining to be activated, or Office prompts users to activate now, or similar. This doesn’t necessarily indicate an issue with PVS image preparation, or with the streamed image. It’s up t...

Getting "Request not supported" while launching a published Desktop with FAS enabled

Launching of a published desktop fails when StoreFront server is configured to use FAS. You will get an error "Request Not Supported ". The below error may be seen in Kerberos event logs on the VDA when attempting to launch. 0x10 - KDCERRPADATATYPENOSUPP: KDC has no support for padata type Kerber...

Windows Remote Incident Response: CimSweep

Windows Remote Incident Response CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CimSweep may also be used to engage in offensive reconnaissance without the need to drop any payload to...

Python Windows Event Log Parser: python-evtx

Python Windows Event Log Parser python-evtx is a pure Python parser for recent Windows Event Log files those with the file extension “.evtx”. The module provides programmatic access to the File and Chunk headers, record templates, and event entries. For example, you can use python-evtx to review...

WMI vs. WMI: Monitoring for Malicious Activity

Hello my name is: WMI WMI has been a core component of Windows since Windows 98, but it is not exactly old wine in a new bottle. WMI more closely resembles that bottle of ‘61 Bordeaux wine that continues to impress us as it ages and matures. WMI was developed as Microsoft’s interpretation of...

Windows Process Filtering System: ProcFilter

Windows Process Filtering System ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with Microsoft’s ETW API , making...

The vulnerability of the Windows operating system allows a malicious intruder to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in the Windows event log system and is related to the processing of specially crafted files. Exploiting this vulnerability enables remote execution of code provided that the user opens a specially crafted event log file. If the user...

The vulnerability in the Windows Desktop Experience software allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information.

A vulnerability that allows for remote execution of code exists in the Windows event log system and is related to the processing of specially crafted files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted event log file. If the user...

Vulnerability of the Windows operating system, allowing a perpetrator to execute arbitrary code

The vulnerability of the Windows operating system is related to a numerical overflow during the processing of event log files. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code using a specially crafted JNT file...