Axessh 4.2 - (Log file name) Denial of Service Exploit

Exploit Title: Axessh 4.2 'Log file name' - Denial of Service PoC Discovery by: Victor Mondragón Vendor Homepage: http://www.labf.com Software Link: http://www.labf.com/download/axessh.exe Tested Version: 4.2 Tested on: Windows 7 Service Pack 1 x32 Steps to produce the crash: 1.- Run python code:...

candlepin: credentials exposure through log files

It was discovered that a world-readable log file, belonging to the Candlepin component of Red Hat Satellite 6.4, leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from...

How to enable debug logging for Citrix WEM Cloud Authentication Service and Citrix WEM Cloud Messaging Service on Cloud Connectors

The Workspace Environment Management WEM service is a Citrix Workspace product. Similar to on-premise WEM, the WEM Service Agent needs to connect to the WEM service Broker. In order to do so, the WEM Service Agent must first request the WEM service Broker's URL and a service key from a Citrix Clo...

Easy WP SMTP v1. 3. 9）0 day vulnerability is being attacked in the process and reproducibility-vulnerability warning-the black bar safety net

Foreword Your own blog site with wordpres hosting, last month found some abnormalities. 3.12 days, the mailbox explosion, received more than 100 letter on the site is the blasting of the notification mail. ! Day to see also not strange, because before it appeared such a situation, every day there...

CVE-2019-7404

An issue was discovered on LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file via an HTTP request containing its full pathname, such as http://192.168.0.1/var/gapm7100$today'sdate.log for reading a filename such as gapm7100190101.log...

CVE-2019-7404

CVE-2019-7404 affects LG GAMP-7100, GAPM-7200, and GAPM-8000 routers. An unauthenticated user can read a log file by issuing an HTTP request that includes the file’s full pathname (for example, http://192.168.0.1/var/gapm7100_${today’s_date}.log). The connected Red Hat and CVE records reiterate t...

EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1488)

According to the versions of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in the way the Linux kernel handled IRET faults during the processing of NMIs. An unprivileged, local user could...

SUSE-SU-2019:1166-1 Security update for audit

This update for audit fixes the following issues: Audit on SUSE Linux Enterprise 12 SP3 was updated to 2.8.1 to bring new features and bugfixes. bsc1125535 FATE326346 Many features were added to auparsenormalize cli option added to auditd and audispd for setting config dir In auditd, restore the...

CVE-2019-6158

An internal product security audit of Lenovo XClarity Administrator LXCA discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x...

CVE-2019-6158

The CVE-2019-6158 case affects Lenovo XClarity Administrator (LXCA). Concrete details in the connected sources show that HTTP proxy credentials were written to a log file in clear text, impacting LXCA versions 2.0.0 to 2.3.x when proxy credentials are configured. The practical impact is informati...

CVE-2019-6158: Insertion of Sensitive Information into Log File

An internal product security audit of Lenovo XClarity Administrator LXCA discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x...

PT-2019-17991

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Administrator versions 2.0.0 through 2.3.x Description An internal product security audit discovered that HTTP proxy credentials are being written to a log file in clear text when HTTP proxy credentials have been configured...

XClarity Administrator (LXCA) Service Data May Include Proxy Credentials - Lenovo Support US

No description provided...

Improper Access Control

Oracle MySQL is vulnerable to improper access control. MySQL init script mishandles initialization of the database data directory and permission setting on the error log file allowing local attackers to escalate their privileges to root or cause a system crash...

DEBIAN-CVE-2019-11675

The groonga-httpd package 6.1.5-1 for Debian sets the /var/log/groonga ownership to the groonga account, which might let local users obtain root access because of unsafe interaction with logrotate. For example, an attacker can exploit a race condition to insert a symlink from /var/log/groonga/htt...

IBM Jazz Reporting Service Information Disclosure Vulnerability (CNVD-2019-14395)

IBM Jazz Reporting Service JRS is a suite of applications for discovering cross-project reports from IBM USA. The program can be used in integration with IBM RationalCLM's Rational solution for managing all lifecycles of development projects. CLM users can access the reports provided by JRS in a...

CVE-2019-11492: Insertion of Sensitive Information into Log File

ProjectSend before r1070 writes user passwords to the server logs...

CVE-2019-9734

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...

CVE-2019-9734

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...

Design/Logic Flaw

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...