4668 matches found
Axessh 4.2 - (Log file name) Denial of Service Exploit
Exploit Title: Axessh 4.2 'Log file name' - Denial of Service PoC Discovery by: Victor Mondragón Vendor Homepage: http://www.labf.com Software Link: http://www.labf.com/download/axessh.exe Tested Version: 4.2 Tested on: Windows 7 Service Pack 1 x32 Steps to produce the crash: 1.- Run python code:...
candlepin: credentials exposure through log files
It was discovered that a world-readable log file, belonging to the Candlepin component of Red Hat Satellite 6.4, leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from...
How to enable debug logging for Citrix WEM Cloud Authentication Service and Citrix WEM Cloud Messaging Service on Cloud Connectors
The Workspace Environment Management WEM service is a Citrix Workspace product. Similar to on-premise WEM, the WEM Service Agent needs to connect to the WEM service Broker. In order to do so, the WEM Service Agent must first request the WEM service Broker's URL and a service key from a Citrix Clo...
Easy WP SMTP v1. 3. 9）0 day vulnerability is being attacked in the process and reproducibility-vulnerability warning-the black bar safety net
Foreword Your own blog site with wordpres hosting, last month found some abnormalities. 3.12 days, the mailbox explosion, received more than 100 letter on the site is the blasting of the notification mail. ! Day to see also not strange, because before it appeared such a situation, every day there...
CVE-2019-7404
An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100$today'sdate.log for reading a filename such as gapm7100190101.log...
CVE-2019-7404
CVE-2019-7404 affects LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file by issuing an HTTP request that includes the file’s full pathname (for example, http://192.168.0.1/var/gapm7100_${today’s_date}.log). The connected Red Hat and CVE records reiterate t...
EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1488)
According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could...
SUSE-SU-2019:1166-1 Security update for audit
This update for audit fixes the following issues: Audit on SUSE Linux Enterprise 12 SP3 was updated to 2.8.1 to bring new features and bugfixes. bsc1125535 FATE326346 Many features were added to auparsenormalize cli option added to auditd and audispd for setting config dir In auditd, restore the...
CVE-2019-6158
An internal product security audit of Lenovo XClarity Administrator LXCA discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x...
CVE-2019-6158
The CVE-2019-6158 case affects Lenovo XClarity Administrator (LXCA). Concrete details in the connected sources show that HTTP proxy credentials were written to a log file in clear text, impacting LXCA versions 2.0.0 to 2.3.x when proxy credentials are configured. The practical impact is informati...
XClarity Administrator (LXCA) Service Data May Include Proxy Credentials - Lenovo Support US
No description provided...
Improper Access Control
Oracle MySQL is vulnerable to improper access control. MySQL init script mishandles initialization of the database data directory and permission setting on the error log file allowing local attackers to escalate their privileges to root or cause a system crash...
DEBIAN-CVE-2019-11675
The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/htt...
IBM Jazz Reporting Service Information Disclosure Vulnerability (CNVD-2019-14395)
IBM Jazz Reporting Service JRS is a suite of applications for discovering cross-project reports from IBM USA. The program can be used in integration with IBM RationalCLM's Rational solution for managing all lifecycles of development projects. CLM users can access the reports provided by JRS in a...
CVE-2019-9734
Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...
CVE-2019-9734
Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...
Design/Logic Flaw
Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...
Information disclosure
aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component...
