CVE-2020-8442

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client...

CVE-2020-8442

CVE-2020-8442 affects OSSEC-HIDS up to version 3.5.0. The vulnerability is a heap-based buffer overflow in the rootcheck decoder inside the server component responsible for log analysis (ossec-analysisd) when accessed by an authenticated client. Affected range: OSSEC-HIDS 2.7–3.5.0. Exploitation ...

CVE-2020-8443

CVE-2020-8443 affects OSSEC-HIDS 2.7–3.5.0: the server component ossec-analysisd is vulnerable to an off-by-one heap-based buffer overflow when cleaning crafted syslog messages passed from authenticated remote agents via ossec-remoted into the analysis queue. Public disclosures across multiple fe...

CVE-2020-8444

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to a use-after-free during processing of ossec-alert formatted msgs received from authenticated remote agents and delivered to the analysisd processing queue by ossec-remoted...

CVE-2020-8444

CVE-2020-8444 affects OSSEC-HIDS server component ossec-analysisd (versions 2.7–3.5.0) and is due to a use-after-free while processing ossec-alert messages from authenticated remote agents via ossec-remoted. Public data assigns a CVSS v3.1 base score of 9.8 (CRITICAL; NETWORK attack, no privilege...

CVE-2020-8446

CVE-2020-8446 affects OSSEC-HIDS 2.7–3.5.0. The server component ossec-analysisd is vulnerable to a path traversal with write access, exploitable by a local user through crafted syscheck messages sent to the analysisd UNIX domain socket. Impact: integrity is HIGH, confidentiality and availability...

CVE-2020-8446

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis ossec-analysisd is vulnerable to path traversal with write access via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user...

CVE-2020-8448

OSSEC-HIDS CVE-2020-8448 affects 2.7–3.5.0; the server component ossec-analysisd is vulnerable to a denial of service via a NULL pointer dereference when local users craft messages sent to the analysisd UNIX domain socket. Impact is a local DoS with partial availability impact per CVSS. Mitigatio...

PT-2020-20146 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The server component responsible for log analysis, ossec-analysisd, is vulnerable to path traversal with write access via crafted syscheck messages written directly to the analysisd UNIX doma...

PT-2020-20142 · Trend Micro · Ossec-Hids

Name of the Vulnerable Software and Affected Versions: OSSEC-HIDS versions 2.7 through 3.5.0 Description: The server component responsible for log analysis, ossec-analysisd, is vulnerable to a heap-based buffer overflow in the rootcheck decoder component via an authenticated client...

Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware

Indicator of Compromise Scanner for CVE-2019-19781 This repos...

Veeam Intelligent Diagnostics signature UID field

If you are not using Veeam ONE or your Veeam ONE server is not connected and monitoring Veeam Backup & Replication, you will not have a VID to enter during case creation. Simply leave the field blank. Purpose This article provides answers to frequently asked questions about the "Veeam Intelligent...

Citrix Releases Patches for Critical ADC Vulnerability Under Active Attack

Citrix has finally started rolling out security patches for a critical vulnerability in ADC and Gateway software that attackers started exploiting in the wild earlier this month after the company announced the existence of the issue without releasing any permanent fix. I wish I could say, "better...

How Organizations Can Defend Against Advanced Persistent Threats

Advanced persistent threats APTs have emerged to be legitimate concerns for all organizations. APTs are threat actors that breach networks and infrastructures and stealthily lurk within them over extended spans of time. They typically perform complex hacks that allow them to steal or destroy data...

Security Bulletin: A vulnerability in Apache Solr (lucene) affects IBM Operations Analytics - Log Analysis (CVE-2019-4243)

Summary A vulnerability on unrestricted access was addressed by IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID: CVE-2019-4243 DESCRIPTION: CVSS Base score: 5.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159517 for the current score. CVSS...

Security Bulletin: Log Analysis is vulnerable to a client side scripting attack due to missing HTTPOnly and Secure attribute in the cookie

Summary A remote attacker is able to obtain sensitive information cause by the failure to set the HttpOnly and Secure attribute in the cookie. This allow attacker to intercept the transmission and obtain information from the cookie in clear text Vulnerability Details CVEID: CVE-2019-4214...

Security Bulletin: IBM Operations Analytics - Log Analysis is vulnerable to potential Host Header Injection (CVE-2019-4216)

Summary IBM Operations Analytics - Log Analysis is vulnerable to HTTP header injection, as attacker can abuse the HTTP Host header. Vulnerability Details CVEID: CVE-2019-4216 DESCRIPTION: CVSS Base score: 4.6 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159187 fo...

Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Apache Zookeeper vulnerability (CVE-2019-4244)

Summary IBM Operations Analytics - Log Analysis has addressed the following vulnerability in Apache ZooKeeper. CVEs: CVE-2019-4244 Vulnerability Details CVEID: CVE-2019-4244 DESCRIPTION: CVSS Base score: 9.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159518 for...

Security Bulletin: Clickjacking vulnerability in IBM Operations Analytics - Log Analysis (CVE-2019-4215)

Summary There is a clickjacking vulnerability in IBM Operations Analytics - Log Analysis Vulnerability Details CVEID: CVE-2019-4215 DESCRIPTION: CVSS Base score: 6.1 CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/159186 for the current score. CVSS Vector:...

Nginx Log Check - Nginx Log Security Analysis Script

Nginx Log Security Analysis Script Features Statistics Top 20 Address SQL injection analysis Scanner alert analysis Exploit detection Sensitive path access File contains attack Webshell Find URLs with response length Top 20 Looking for rare script file access Find script file for 302 redirect Usa...