GHSA-G96C-X7RH-99R3 Graylog vulnerable to insecure source port usage for DNS queries

Summary Graylog utilises only one single source port for DNS queries. Details Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered ho...

Graylog vulnerable to insecure source port usage for DNS queries

Summary Graylog utilises only one single source port for DNS queries. Details Graylog seems to bind a single socket for outgoing DNS queries. That socket is bound to a random port number which is not changed again. This goes against recommended practice since 2008, when Dan Kaminsky discovered ho...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.1.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=1.0.0 <=5.0.0) +12 more potentially affected by CVE-2023-41041 via org.graylog2:graylog2-server (>=1.0.0-beta.3 <=5.0.8)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1, =2.2.0, =1.1.0, =2.2.0, =2.2.0, =1.0.3, =1.0.0, =1.2.0, =1.3.4 Source cves: CVE-2023-41041 Source advisory: OSV:GHSA-3FQM-FRHG-7C85...

Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (=5.2.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (=5.1.2) +3 more potentially affected by CVE-2023-41041 via org.graylog2:graylog2-server (>=5.1.0 <=5.1.2)

org.graylog2:graylog2-server MAVEN version =5.1.0, =5.1.0, =5.1.0, =5.1.13 Source cves: CVE-2023-41041 Source advisory: OSV:GHSA-3FQM-FRHG-7C85...

GHSA-3FQM-FRHG-7C85 Graylog user session is still usable after logout

Summary In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time. Details Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the...

PT-2023-27758 · Graylog · Graylog

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 5.0.9 Graylog versions prior to 5.1.3 Description: Graylog makes use of only one single source port for DNS queries, which goes against recommended practice since 2008, when Dan Kaminsky discovered how easy it is to...

Graylog Detection Consolidation

Consolidation of Graylog detections. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it...

Malicious code in bfx-facs-graylog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c827ea9bb1a85af6bce95ec512fdc282af7bf7d6d2a00174548b5d52c710d1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29711

LibreNMS v22.3.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /Table/GraylogController.php...

LibreNMS 跨站脚本漏洞

LibreNMS is a PHP and MySQL based open source network monitoring system from the LibreNMS community. The system features custom alerts, auto-discovery of network environments and automatic updates.LibreNMS v22.3.0 version contains a cross-site scripting vulnerability that originates from the...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0 <=4.5.0) +67 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-sync (>=3.12.0 <=3.12.7)

org.mongodb:mongodb-driver-sync MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =3.0.0-alpha-15, =3.0.0-alpha-15, =4.5.0, =5.2.1, =5.2.1, =1.1.0.20221115, =1.5.0 and more Source cves: CVE-2021-20328 Source advisory: OSV:GHSA-RGHW-6PX2-FGWC...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=4.0.0 <=4.1.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=4.0.0 <=4.5.0) +38 more potentially affected by CVE-2021-20328 via org.mongodb:mongodb-driver-legacy (>=3.12.0 <=3.12.7)

org.mongodb:mongodb-driver-legacy MAVEN version =3.12.0, =4.0.0, =4.0.0, =4.0.0, =4.0.1, =4.4.1 - com.github.rinoto.mongo:migramongo-core =1.4 - com.github.rinoto.mongo:migramongo-reflections =1.4 - com.github.rinoto.mongo:migramongo-spring =1.4 - com.github.rinoto.mongo:migramongo-spring-web =1....

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (=1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0 <=1.0.1) +8 more potentially affected by CVE-2018-11651 via org.graylog2:graylog2-server (>=1.0.0-beta.3 <=2.4.3)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0, =1.1.0, =2.2.0, =2.2.0, =1.0.3, =1.0.0, =1.2.0, =1.3.4 Source cves: CVE-2018-11651 Source advisory: OSV:GHSA-435G-R2M8-GJVM...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (=1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0 <=1.0.1) +8 more potentially affected by CVE-2018-11650 via org.graylog2:graylog2-server (>=1.0.0-beta.3 <=2.4.3)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0, =1.1.0, =2.2.0, =2.2.0, =1.0.3, =1.0.0, =1.2.0, =1.3.4 Source cves: CVE-2018-11650 Source advisory: OSV:GHSA-H7G4-65MF-6MXH...

Cross-site Scripting in Graylog

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

GHSA-H7G4-65MF-6MXH Cross-site Scripting in Graylog Server

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

GHSA-435G-R2M8-GJVM Cross-site Scripting in Graylog

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

Cross-site Scripting in Graylog Server

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (=1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0 <=1.0.1) +8 more potentially affected by CVE-2018-14380 via org.graylog2:graylog2-server (>=1.0.0-beta.3 <=2.4.5)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0, =1.1.0, =2.2.0, =2.2.0, =1.0.3, =1.0.0, =1.2.0, =1.3.4 Source cves: CVE-2018-14380 Source advisory: OSV:GHSA-38HF-XJMX-JRH8...