Pi-hole 跨站脚本漏洞

Pi-hole is a multi-platform, network-wide ad-blocking tool. A stored cross-site scripting vulnerability exists in DNS query logs in versions prior to Pi-hole 5.2.2. An attacker can exploit this vulnerability by directly or indirectly querying DNS using a malicious hostname to execute arbitrary...

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

...

Vulnerabilities fixed in MediaWiki

The developers of MediaWiki have fixed a number of vulnerabilities fixed in the latest software update. A malicious party could potentially exploit the vulnerabilities potentially exploit them to gain access to sensitive data, because in certain circumstances user data may end up in accessible...

How to Gain Visibility Into Audit Logs for Policy Customization in InsightVM

Since the launch of InsightVM’s Custom Policy Builder in June of this year, hundreds of organizations have created and customized secure configuration policies. While the standard CIS and DISA benchmarks are, by default, great for an organization to kickstart their policy and compliance program,...

X-STREAM enhanced XEGP Authorization Issues Vulnerability

The Emerson Rosemount X-STREAM Gas Analyzer is an Emerson gas analyzer for industrial environments. The device supports up to five component gas analyzers and features NDIR/UV/VIS photometry, paramagnetic and electrochemical O2, thermal conductivity and humidity sensors. X-STREAM enhanced XEGP Al...

GitLab Information Disclosure Vulnerability (CNVD-2021-14192)

GitLab is a product of the U.S. et all are U.S. GitLab company.GitLab is a self-hosted, Git version control system project repository application developed using Ruby on Rails.Git et all are products of Git, a free, open source distributed version control system.Rails et all are products of the...

CVE-2020-0476

In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. This could lead to local information disclosure with System execution privileges required. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID:...

CVE-2020-35470

Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the proxy protocol header. This affects situations with tcp-proxy as the network filter not HTTP filters...

Rumble Mail Server 0.51.3135 - 'domain and path' Stored XSS

Exploit Title: Rumble Mail Server 0.51.3135 - 'domain and path' Stored XSS Date: 2020-9-3 Exploit Author: Mohammed Alshehri Vendor Homepage: http://rumble.sf.net/ Software Link: https://sourceforge.net/projects/rumble/files/Windows%20binaries/rumble0.51.3135-setup.exe Version: Version 0.51.3135...

CVE-2020-7539

creationtimestamp| type| source ---|---|--- 2020-12-11 07:35:22+00:00| seen| https://t.me/cibsecurity/19783 2020-12-11 07:38:21+00:00| seen| https://t.me/cibsecurity/19803 2020-12-11 08:25:40+00:00| seen| https://t.me/cibsecurity/19823 2020-12-11 09:25:35+00:00| seen| https://t.me/cibsecurity/198...

CVE-2020-7537

creationtimestamp| type| source ---|---|--- 2020-12-11 07:35:18+00:00| seen| https://t.me/cibsecurity/19779 2020-12-11 07:38:17+00:00| seen| https://t.me/cibsecurity/19799 2020-12-11 08:25:34+00:00| seen| https://t.me/cibsecurity/19819 2020-12-11 09:25:29+00:00| seen| https://t.me/cibsecurity/198...

CVE-2020-26416

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions =8.4 to =13.5 to =13.6 to 13.6.2...

CVE-2020-26416

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions =8.4 to =13.5 to =13.6 to 13.6.2...

Information disclosure

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions =8.4 to =13.5 to =13.6 to 13.6.2...

CVE-2020-26416

GitLab EE Information Disclosure (CVE-2020-26416): The Advanced Search component exposes search terms via Rails logs. Affected: GitLab EE versions 8.4 and later, with specific ranges: >=8.4 to =13.5 to =13.6 to

PT-2020-16421 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 8.4 through 13.4.6 GitLab EE versions 13.5 through 13.5.4 GitLab EE versions 13.6 through 13.6.1 Description: The issue is related to information disclosure in the Advanced Search component of GitLab EE, starting from versi...

CVE-2020-24444

creationtimestamp| type| source ---|---|--- 2020-12-10 12:33:47+00:00| seen| https://t.me/cibsecurity/18720 2020-12-10 12:41:07+00:00| seen| https://t.me/cibsecurity/18740 2020-12-10 13:25:23+00:00| seen| https://t.me/cibsecurity/18760 2020-12-10 14:03:16+00:00| seen| https://t.me/cibsecurity/187...

CVE-2020-29666

In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value...

Directory traversal

In Lan ATMService M3 ATM Monitoring System 6.1.0, due to a directory-listing vulnerability, a remote attacker can view log files, located in /websocket/logs/, that contain a user's cookie values and the predefined developer's cookie value...

CVE-2020-2495

creationtimestamp| type| source ---|---|--- 2020-12-10 07:33:38+00:00| seen| https://t.me/cibsecurity/18566 2020-12-10 07:36:39+00:00| seen| https://t.me/cibsecurity/18586 2020-12-10 08:25:37+00:00| seen| https://t.me/cibsecurity/18606 2020-12-10 09:25:28+00:00| seen| https://t.me/cibsecurity/186...