Information Disclosure

ansible is vulnerable to information disclosure. The logs, stdout and stderr from SSH can potentially contain sensitive information when a retry task run with -vvv option fails...

Escape Sequence Injection

Fluentd is vulnerable to escape sequence injection attacks. User input is pushed directly to the logs without filtering, allowing an attacker to change the terminal UI or execute commands on the device parsing the logs...

Privilege Escalation

rh-mariadb100-mariadb is vulnerable to privilege escalation attacks. The vulnerability exists as mysqldsafe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6.x before 5.6.32-78-1, and 5.7.x before 5.7.14-8; and Percona...

Information Disclosure

ansible is vulnerable to information disclosure. The application doesn't properly enforce the nolog flag, meaning that sensitive information that has been passed to the task will be logged by the system. This allows a malicious user with access to the logs can gain access to this sensitive...

Information Disclosure

ansible is vulnerable to information disclosure. The library contains a configuration example for passing Jenkins credentials as parameters. These parameters are logged, allowing a malicious user with access to the logs to have access to view the Jenkins credentials...

Information Disclosure

openstack-nova is vulnerable to information disclosure attacks. The vulnerability exists as an issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may...

Arbitrary Log Read

github.com/kubernetes/kubernetes is vulnerable to arbitrary log reads. Using a container name, attackers are able to read the pod logs...

Security update for sssd (moderate)

openSUSE Security Update: Security update for sssd Announcement ID: openSUSE-SU-2019:0051-1 Rating: moderate References: 1010700 1072728 1080156 1087320 1098377 1101877 1110299 Cross-References: CVE-2018-10852 Affected Products: openSUSE Leap 42.3 An update that solves one vulnerability and has 6...

DEBIAN-CVE-2018-16866

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable...

LogonTracer Code Injection Vulnerability

LogonTracer is a visual Windows log analysis tool that checks for malicious logins by analyzing Windows Active Directory event logs. A code injection vulnerability exists in LogonTracer version 1.2.0 and prior versions, which can be exploited by a remote attacker to execute arbitrary Python code ...

Digging Up the Past: Windows Registry Forensics Revisited

ARCHIVED STORY Digging Up the Past: Windows Registry Forensics Revisited By David Via · Jan 08, 2019 Introduction FireEye consultants frequently utilize Windows registry data when performing forensic analysis of computer networks as part of incident response and compromise assessment missions. Th...

"Cannot complete request" when logging on via NetScaler using dual factor authentication and SSON to StoreFront Server 3.14

After configuring a remote portal with StoreFront servers load balanced with NetScaler, a user authenticates and they get the error "Cannot complete your request". From the event Viewer logs of the StoreFront SF server: "An error occurred while using SSL configuration for endpoint 0.0.0.443. The...

PT-2019-1257 · Systemd +5 · Systemd-Journald +5

Name of the Vulnerable Software and Affected Versions: systemd-journald versions v221 through v239 Description: An out of bounds read was discovered in the way systemd-journald parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data...

CVE-2018-14995

The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blade Spark Android device with a build fingerprint of ZTE/Z971/peony:7.1.1/NMF26V/20171129.143111:user/release-keys, the ZTE ZMAX Pro Android device with a buil...

Design/Logic Flaw

The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blade Spark Android device with a build fingerprint of ZTE/Z971/peony:7.1.1/NMF26V/20171129.143111:user/release-keys, the ZTE ZMAX Pro Android device with a buil...

CVE-2018-15007

The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069trxl601sky/x6069trxl601sky:6.0/MRA58K/1482897127:user/release-keys contains a pre-installed platform app with a package name of com.fw.upgrade.sysoper versionCode=238, versionName=2.3.8 that contains an exported broadcast...

The Citrix Profile Management service failed to start when PathToLogFile parameter is set to a remote machine

Citrix Profile Management is not operating on the VDA because the Citrix Profile Management service failed to start in a timely fashion. This occurs when the “Path to log file” Profile Management policy or PathToLogFile parameter has been set to a remote machine UNC path. The event logs may inclu...

Information disclosure

IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 124747. IBM X-Force ID: 124747...

CVE-2017-1272

IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 124747. IBM X-Force ID: 124747...

IBM Security Guardium Information Disclosure Vulnerability (CNVD-2018-26032)

IBM Security Guardium is a suite of platforms from IBM in the United States that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. An information disclosure vulnerability exists in IBM Security Guardiu...