9425 matches found
Updated ansible package fixes security vulnerabilities
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...
CVE-2020-3541
A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to gain access to sensitive information. The vulnerability is due to unsafe loggin...
GHSA-P77H-HV6G-FMFP Sensitive Data Exposure in ibm_db
Versions of ibmdb prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode. Recommendation Upgrade to version 2.6.0 or later and ensure sensitive information was not logged...
Ansible: masked keys for uri module are exposed into content and json output
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...
Exporting Nginx Access Logs to an ELK Cluster
The Wallarm WAF provides an organization with the ability to protect their applications and APIs against a wide range of attacks. However, an organization may wish to achieve a greater degree of visibility into attack traffic and alerts than is possible via the Wallarm user interface. The Wallarm...
Exporting Nginx Access Logs to an ELK Cluster
The Wallarm WAF provides an organization with the ability to protect their applications and APIs against a wide range of attacks. However, an organization may wish to achieve a greater degree of visibility into attack traffic and alerts than is possible via the Wallarm user interface. The Wallarm...
Iblessing - An iOS Security Exploiting Toolkit, It Mainly Includes Application Information Collection, Static Analysis And Dynamic Analysis
iblessing iblessing is an iOS security exploiting toolkit, it mainly includes application information collection , static analysis and dynamic analysis. iblessing is based on unicorn engine and capstone engine. Features Cross-platform: Tested on macOS and Ubuntu. iOS App static info extract,...
CVE-2020-24390
eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/adminlogs page, which might allow pre-authentication stored XSS during login/logout logs recording...
CVE-2020-4172
IBM Security Guardium Insights 2.0.1 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 174408...
Malicious Package
MintegralAdSDK is a malicious package. The package performs malicious functionalities such as tracking any URL opened by the app, intercepting and hijacking a user ad-click and activity, sending logs to third-party server and performing advertisement attribution fraud regardless of serving ad is...
Input validation
Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker...
U.S. Dept Of Defense: Elmah.axd is publicly accessible and leaking Error Log for ROOT on █████_PRD_WEB1 █████████elmah.axd
Description: Hello, Security team, hope you are doing well. I found out that elmah.axd is publicly accessible on ████████ which is leaking error log which contain cookies and server code etc. Step-by-step Reproduction Instructions 1. Go to ██████elmah.axd and you will see the error logs. 2. Same...
One Weird Trick for Reviewing Zeek Logs on the Command Line!
Are you a network security monitoring dinosaur like me? Do you prefer to inspect your Zeek logs using the command line instead of a Web-based SIEM? If yes, try this one weird trick! I store my Zeek logs in JSON format. Sometimes I like to view the output using jq. If I need to search directories ...
CVE-2020-7307
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention DLP for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials...
CVE-2020-7306
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention DLP for Mac prior to 11.5.2 allows local users to gain access to the ADRMS username and password via unprotected log files containing plain text...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
CVE-2020-15829
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
Design/Logic Flaw
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs...
CVE-2020-15829
CVE-2020-15829 affects JetBrains TeamCity prior to 2019.2.3, where password parameters could be disclosed via build logs. The issue is documented in multiple sources (NVD/NVD-reported; Red Hat and CVE listings) and appears under the TeamCity component in JetBrains’ Q2 2020 security bulletin (TW-6...
