[ASA-202108-12] loki: directory traversal

Arch Linux Security Advisory ASA-202108-12 ========================================== Severity: Medium Date : 2021-08-10 CVE-ID : CVE-2021-36156 Package : loki Type : directory traversal Remote : Yes Link : https://security.archlinux.org/AVG-2250 Summary ======= The package loki before version...

Directory Traversal

github.com/grafana/loki is vulnerable to directory traversal. An attacker is able to input malicious rules files with a pathname in the header value X-Scope-OrgID that will expose the location and contents at that location...

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

Directory traversal

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

CVE-2021-36156

Grafana Loki (≤ 2.2.1) is affected by CVE-2021-36156: crafting the X-Scope-OrgID header can cause directory traversal when Loki builds file paths to rules files, potentially causing the service to parse and leak parts of arbitrary files in error messages. Public advisories (Arch Linux ASA-202108-...

CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

PT-2021-21144

Name of the Vulnerable Software and Affected Versions: Grafana Loki versions through 2.2.1 Description: An issue was discovered where the header value X-Scope-OrgID is used to construct file paths for rules files. If this value is crafted to conduct directory traversal, such as...

CVE-2021-36156: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that locatio...

Grafana 路径遍历漏洞

Grafana is a set of open source monitoring tools from Grafana Labs that provide a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, and Prometheus, among others. A security vulnerability exists in Grafana Loki 2.2.1 and earlier versions, which stem...

Fenrir - Simple Bash IOC Scanner

Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g. "temp/p.exe" in "/var/temp/p.exe"...

Popular Malware Families Using 'Process Doppelgänging' to Evade Detection

The fileless code injection technique called Process Doppelgänging is actively being used by not just one or two but a large number of malware families in the wild, a new report shared with The Hacker News revealed. Discovered in late 2017, Process Doppelgänging is a fileless variation of Process...

Spam and phishing in Q3 2018

Quarterly highlights Personal data in spam We have often said that personal data is candy on a stick to fraudsters and must be kept safe that is, not given out on dubious websites. It can be used to gain access to accounts and in targeted attacks and ransomware campaigns. In Q3, we registered a...

Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox

This blog post was authored by Edmund Brumaghin and Holger Unterbrink with contributions from Emmanuel Tacheau. Executive Summary Cisco Talos has discovered a new malware campaign that drops the sophisticated information-stealing trojan called "Agent Tesla," and other malware such as the Loki...

Loki Bot: On a hunt for corporate passwords

Starting from early July, we have seen malicious spam activity that has targeted corporate mailboxes. The messages discovered so far contain an attachment with an .iso extension that Kaspersky Lab solutions detect as Loki Bot. The malware's key objective is to steal passwords from browsers,...

Wave of Java-Based RATs Target Tax Filers

Spammers are spreading Java-based remote access Trojans, known as jRATs, targeting tax filers with attachments named “IRS Updates.jar” and “ImportantPDF.jar” that, if executed, give attackers access to compromised endpoints. Zscaler, which is tracking the jRATs, believes some of the campaigns cou...

Loki Download Manager 2.0 Default.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13898/info Loki Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'default.asp' script before using it in an SQL...

Loki Download Manager 2.0 Catinfo.ASP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/13900/info Loki Download Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'catinfo.asp' script before using it in an SQL...

lokiSQL.txt

hi all tow SQL injection in Loki download manager 1. in http://localhost/adm/default.asp user: anyuser pass: 'or''=' 2. in http://localhost/downmancv/catinfo.asp?cat=' union select null,null,user,null,null,null,null,null,pass,null,null,null,null,null FROM tblAdm ' and u will have user and pass h4...

CVE-2005-1943

Multiple SQL injection vulnerabilities in Loki download manager 2.0 allow remote attackers to execute arbitrary SQL commands via the 1 password field to default.asp or 2 cat parameter to catinfo.asp...