CVE-2013-2674

CVE-2013-2674 affects Brother MFC-9970CDW devices with firmware around 1.10 L, where an information-disclosure vulnerability arises from inadequate handling of HTTP referrer headers, allowing remote attackers to view sensitive data from referrer logs. The available documents identify the affected...

PT-2020-20126 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla! versions prior to 3.9.15 Description: An issue was discovered that allows XSS attacks due to inadequate escaping of usernames in com actionlogs. Recommendations: For versions prior to 3.9.15, update to version 3.9.15 or later to resol...

Sensitive Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure. The library displays sensitive tokens in the logs and response bodies allowing a malicious user who has access to the logs to access sensitive information...

Starbucks: Korea - LFI via path traversal at https://msr.istarbucks.co.kr:6443/appif/

@iampuky — thank you for reporting the original vulnerability and for confirming the resolution. While analyzing the Starbucks Korea mobile application, i noticed that it called an API at https://msr.istarbucks.co.kr:6443/appif/. It was found that the application running under that directory was...

Threat Analysis Unit (TAU) Threat Intelligence Notification: SatanCryptor Ransomware

In early January 2020, a new ransomware named ‘SatanCryptor’ was discovered. After it performs file encryption, it will drop a ransom note named “ SATAN CRYPTOR .hta” and append ‘.satan’ as a file extension to the encrypted files. In addition, SatanCryptor will delete itself after the execution t...

How to change the default lifetime of Compositing Engine packaging machine in ELM

By default, if finalization has not begun in 3 days of time since the Packaging Machine was created, the task will be canceled with a timeout error. On the ELM logs, you may see something like the below: 2020-01-02 13:43:59,486 ERROR 61605 CompositingEngineP: Timeout occured after...

"Cablehaunt" Cable Modem WebSocket DoS

There exists a buffer overflow vulnerability in certain Cable Modem Spectrum Analyzer interfaces. This overflow is exploitable, but since an exploit would differ between every make, model, and firmware version which also differs from ISP to ISP, this module simply causes a Denial of Service to te...

CVE-2012-3490

creationtimestamp| type| source ---|---|--- 2020-01-10 00:32:39+00:00| seen| https://t.me/cibsecurity/9093...

CVE-2019-11292

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...

CVE-2019-17009

When running, the updater service wrote status and log files to an unrestricted location; potentially allowing an unprivileged process to locate and exploit a vulnerability in file handling in the updater service. Note: This attack requires local system access and only affects Windows. Other...

CVE-2019-14854

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

Code injection

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

CVE-2019-14854

CVE-2019-14854 affects OpenShift Container Platform 4 where secret data could be written to static pod logs when an operator runs at Debug level or higher. The root cause is that library-go did not sanitize secret material in logs emitted by the operator. Impact: a low-privilege user could read c...

CVE-2019-14854

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

NewStart CGSL CORE 5.05 / MAIN 5.05 : pacemaker Multiple Vulnerabilities (NS-SA-2019-0258)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has pacemaker packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker coul...

CVE-2019-20071

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

Cross site request forgery (csrf)

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

CVE-2019-20071

CVE-2019-20071 affects Netis DL4323 devices. The issue is a cross-site request forgery (CSRF) vulnerability in the web interface, specifically via the form2logaction.cgi endpoint, which can be abused to delete all logs. The vulnerability is documented across multiple sources (NVD, Red Hat, CVE li...

CVE-2019-20071

On Netis DL4323 devices, CSRF exists via form2logaction.cgi to delete all logs...

CVE-2019-8463

A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be written to non-standard locations...