4671 matches found
Cisco Enterprise NFV Infrastructure Software Cross-Site Scripting Vulnerability
Cisco Enterprise NFV Infrastructure Software is a lightweight virtualization platform that integrates complete VM lifecycle management, monitoring, device programmability, and service chaining in one installable package. A cross-site scripting vulnerability exists in the Web portal framework of...
Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability
A vulnerability in the web portal framework of Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-based interface. The vulnerability is due to improper input validation of log file...
libcgroup: cgrulesengd creates log files with insecure permissions
libcgroup up to and including 0.41 creates /var/log/cgred with mode 0666 regardless of the configured umask, leading to disclosure of information...
keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py
It was discovered that keycloak-httpd-client-install uses a predictable log file name in /tmp. A local attacker could create a symbolic link to a sensitive location, possibly causing data corruption or denial of service...
PT-2019-17014 · Ibm · Ibm Cloud Private
Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 2.1.0, 3.1.0, 3.1.1, 3.1.2 Description: A local privileged user could obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. Recommendations: For IBM...
McAfee DLPe Agent < 11.1.200 / 11.2.x Multiple Vulnerabilities (SB10289) (SB10290)
The version of the McAfee Data Loss Prevention Endpoint DLPe Agent installed on the remote Windows host is prior to 11.1.200 or 11.2.x. It is, therefore, affected by multiple vulnerabilities: - Stored XSS in the ePO extension UI. CVE-2019-3591 - Authenticated command injection in the ePO extensio...
cPanel Information Disclosure Vulnerability (CNVD-2019-29721)
cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A security vulnerability exists in versions prior to cPanel 57.9999.54. An attacker can exploit the vulnerability to read user lo...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
Design/Logic Flaw
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18427
In cPanel before 66.0.2, weak log-file permissions can occur after account modification SEC-289...
CVE-2017-18427
CVE-2017-18427 affects cPanel prior to 66.0.2, where weak log-file permissions can occur after account modification (SEC-289). The issue has been documented in Red Hat and NVD entries with a low severity (CVSS v3: 3.3; v2: 2.1) and a Partial confidentiality impact. Remediation is to apply the pat...
CVE-2016-10817
cPanel before 57.9999.54 allows SQL Injection via the ModSecurity TailWatch log file SEC-123...
CVE-2016-10818
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...
CVE-2016-10818
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...
CVE-2016-10819
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...
CVE-2016-10819
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...
Design/Logic Flaw
cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup SEC-124...