CVE-2021-23046

CVE-2021-23046 affects BIG-IP Guided Configuration. When a configuration containing secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs, exposing sensitive information. The issue applies to Guided Configuration versions ...

CVE-2021-20582

IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 199328...

FUEL CMS SQL Injection Vulnerability (CNVD-2021-74294)

FUEL CMS is a content management system CMS based on the Codelgniter framework. FUEL CMS in version 1.5.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the parameter col in the software's /FUEL/index.php/FUEL/logs/items for externally-inputted SQL...

ProtonMail Now Keeps IP Logs

After being compelled by a Swiss court to monitor IP logs for a particular user, ProtonMail no longer claims that "we do not keep any IP logs." EDITED TO ADD 9/14: This seems to be more complicated. ProtonMail is not yet saying that they keep logs. Their privacy policy still states that they do n...

OESA-2021-1340 sssd security update

SSSD provides a set of daemons to manage access to remote directories and authentication mechanisms such as LDAP, Kerberos or FreeIPA. It provides an NSS and PAM interface toward the system and a pluggable backend system to connect to multiple different account sources. Security Fixes: A flaw was...

‘Azurescape’ Kubernetes Attack Allows Cross-Container Cloud Compromise

A critical security vulnerability allowing attackers to perform cross-account container takeover in Microsoft’s public cloud, dubbed “Azurescape”, has been uncovered by researchers. The issue exists in Azure Container Instances ACI, which is Microsoft’s container-as-a-service CaaS offering which...

CVE-2021-38727

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items...

CVE-2021-38727

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items...

CVE-2021-38727

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

FUEL CMS SQL注入漏洞

FUEL CMS is a content management system CMS based on the Codelgniter framework. FUEL CMS in version 1.5.0 suffers from a SQL injection vulnerability, which originates from the lack of validation of the parameter col in the software's /FUEL/index.php/FUEL/logs/items for externally-inputted SQL...

Cannot actually submit evidence

Handle jmak Vulnerability details Impact Detailed description of the impact of this finding. The SubmitBadSignatureEvidence is not actually registered in the handler and hence no one can actually submit this message, rendering the message useless. This harms the security model of Gravity since...

ProtonMail logged, shared activist’s IP address with Swiss police

By Waqas ProtonMail is being criticized for sharing French activists IP address with Swiss authorities while claiming it does not save logs. End-to-end encrypted email service provider ProtonMail is currently facing criticism after the company shared the IP address of an anti-gentrification...

Sending an unauthenticated request to the Synchrony allows writing to the logs

h3. Issue Summary It is possible to write log entries via Synchrony API without authentication. h3. Steps to Reproduce To do this, you have to enter the target URL in Postman:, copy the GET or POST request and send the http request. For all POST requests, you must ensure that the content length...

openSUSE: Security Advisory for sssd (openSUSE-SU-2021:2941-1)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Puppet Server 日志信息泄露漏洞

Puppet and Puppet Server are both products of Puppet Labs, U.S.A. Puppet is a set of configuration management tools based on a client/server C/S architecture that can be used to manage configuration files, users, cron tasks, packages, system services, and so on.Puppet Server is a software program...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

sssd: shell command injection in sssctl

A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest...

GHSA-H76R-VGF3-J6W5 October CMS auth bypass and account takeover

Impact An attacker can exploit this vulnerability to bypass authentication using a specially crafted persist cookie. - To exploit this vulnerability, an attacker must obtain a Laravel’s secret key for cookie encryption and signing. - Due to the logic of how this mechanism works, a targeted user...

Citrix App Layering | Start Menu does not respond to left click on Windows 10 when template is published via Azure Connector

Start menu does not respond to left click for VDI's created from a template published via the Azure connector The start menu may respond on first logon - but will always fail on second and subsequent logons After logon we see the following events in the application event logs:...