9371 matches found
Synologic NAS IP Blocking Bypass
Greetings, 1. Seems to be possible bypass the default enabled "Auto Block of IP address" functionality in Synologic's NAS by using only one single space \x20 to the HTTP header "X-FORWARDED-FOR" If already Auto Blocked, this bypass will not work Generates in /var/log/messages:...
Fedora 25 : 1:xrdp (2017-8fffbae8af)
WARNING: Please note that this update comes with a slightly different syntax of sesman.ini file, so if you edited this file by hand, you may need to look at the .rpmnew file and merge any required changes by hand. This release also creates three files in /etc/xrdp directory if they don't already...
SMS/MMS & Call Logs to Email - Dynamic Code Loading, External URLs, SD-card access vulnerabilities
HackApp vulnerability scanner discovered that application SMS/MMS & Call Logs to Email published at the 'play' market has multiple vulnerabilities...
Citrix Store Front MMC console crashes with RSA Authentication Agent 1.0 installed.
Even after uninstalling the RSA Authentication Agent 1.0 we get following error in event viewer logs: Error while creating the Citrix StoreFront Snap-in. Microsoft.Practices.Unity.ResolutionFailedException: Resolution of the dependency failed, type =...
McAfee Agent (MA) 'log viewer' Denial of Service Vulnerability
McAfee Agent is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
McAfee ePolicy Orchestrator Agent Remote Log Detection
McAfee ePolicy Orchestrator ePO Agent is running on the remote host, and its logs are viewable by unauthenticated, remote users. This is not the default behavior. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid97212; scriptversion"1.10";...
CVE-2017-5153
An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords...
TalariaX SendQuick Entera and Avera Device Authentication Bypass Vulnerability
TalariaX SendQuick Entera and Avera are both products of TalariaX Singapore. The former is a web-based server management system and the latter is a plug-and-play network monitoring system. A security vulnerability exists in versions of TalariaX SendQuick Entera and Avera devices prior to 2HF16. A...
StoreFront Events : the authentication protocols could not be enumerated because there is no challenge process
Issue : Cannot Complete Your Request From External Access Gateway With Event Logs as "the authentication protocols could not be enumerated because there is no challenge process "...
UBUNTU-CVE-2017-5549
The klsi105getlinestate function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain sensitive information by reading the log...
CVE-2017-5137
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective...
Cross site request forgery (csrf)
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective...
CVE-2017-5137
An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective...
PT-2017-16334 · Sendquick +1 · Sendquick Entera +1
Name of the Vulnerable Software and Affected Versions: SendQuick Entera versions prior to 2HF16 Avera versions prior to 2HF16 Description: An issue allows an attacker to request and download SMS logs without authentication. Recommendations: For SendQuick Entera versions prior to 2HF16, update to...
StoreFront upgrade fails ""The process cannot access the file 'C:\inetpub\wwwroot\Citrix\<store name>\web.config' because it is being used by another process."
In the MSI logs under C:\windows\temp\storefront we see the following exception: "The process cannot access the file 'C:\inetpub\wwwroot\Citrix\web.config' because it is being used by another process."...
admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files
An EAP feature to download server log files allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired...
CVE-2017-2607
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes SECURITY-382. Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins user...
Credential disclosure in LXCA log files - Lenovo Support US
No description provided...
CVE-2016-8982
IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history...