CVE-2025-49004

CVE-2025-49004 affects Caido prior to version 0.48.0. The issue arises from missing DNS rebinding protection, allowing a malicious site to load Caido on an attacker-controlled domain and hijack the authentication flow, potentially enabling remote command execution during the initial setup (and ev...

Laravel Detection Consolidation

Consolidation of Laravel detections. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.135014";...

GHSA-8CGQ-6MH2-7J6V Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Summary Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries. Details The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline...

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Summary Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries. Details The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline...

Escape Sequence Injection vulnerability in Rack lead to Possible Log Injection

Summary Rack::Sendfile can be exploited by crafting input that includes newline characters to manipulate log entries. Details The Rack::Sendfile middleware logs unsanitized header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences such as newline...

CVE-2025-23039

Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...

Microsoft SQL Server Masked Data Exposure

Title: SQL Server Masked Data Exposure Through Brute Force Attack Product: Database Manufacturer: Microsoft Affected Versions: SQL Server 2014, 2016,2017,2019,2022 Tested Versions: SQL Server 2014, 2016,2017,2019,2022 Risk Level: Low Security Feature: Dynamic Data Masking Author of Advisory: Emad...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

CVE-2024-24919 Exploit tool to validate CVE-2024-24919 vulnera...

The vulnerability of the application software interface of the JumpServer system for security audits, which allows a perpetrator to trigger a service failure.

The vulnerability of the application software interface of the JumpServer security audit system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Wireshark Buffer Overflow Vulnerability (CNVD-2023-43872)

Wireshark is a free, open-source network protocol analyzer that helps users capture and analyze network packets.Wireshark can be used for a variety of purposes such as network troubleshooting, security auditing, etc. It is a very useful network tool. Wireshark has a security vulnerability. The...

Microsoft SQL Server 2014 / 2016 / 2017 / 2019 / 2022 Audit Logging Failure Vulnerability

Microsoft SQL Server 2014, 2016, 2017, 2019, and 2022 appears to ignore audit rules for sys.sysxlgns allowing an attacker with administrative permissions to extract password hashes under the radar. Microsoft told the researcher they are not willing to fix it but acknowledge it as a security...

Microsoft SQL Server 2014 / 2016 / 2017 / 2019 / 2022 Audit Logging Failure

Title: Microsoft SQL Server Password Hash Exposure Product: Database Manufacturer: Microsoft Affected Versions: 2012-2022 Risk Level: Medium CVE Reference: N/A Author of Advisory: Emad Al-Mousa Overview: SQL Server is a popular database system, and database systems are a vital backbone in IT...

SUSE CVE-2022-24975

The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by...

Securing Red Hat Enterprise Linux CoreOS in Red Hat OpenShift with Qualys

Qualys full-stack security for Red Hat OpenShift adds visibility, actionable intelligence, and security auditing for Red Hat Enterprise Linux CoreOS, the operating system that underpins OpenShift deployments for running containers securely. With this new offering, Qualys is now the first and only...

Fuzzing HTTP Proxies: Privoxy, Part 1

Research Fuzzing HTTP Proxies: Privoxy, Part 1 Share May 17th, 2021 Here at Opera, we’re always looking for ways to improve the browsing experience of our users with speed and usability. Perhaps more importantly though, we also look for ways to improve users’ privacy and security. While we...

"You cannot logon to the specified server" error when login to Storefront server.

Only certain users cannot log on to storefront. Following events can be seen on the storefront server : Security events logs : Event 4625, Microsoft Window security auditing Failure Information : Failure Reason : User not allowed to logon at this computer. Status : 0xC000006E Citrix Delivery...

Lynis 3.0.0 - Security Auditing Tool for Unix/Linux Systems

We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...

[SECURITY] [DLA 2253-1] lynis security update

Package : lynis Version : 1.6.3-1+deb8u1 CVE ID : CVE-2019-13033 Debian Bug : 963161 It was discovered that there was a vulnerability in lynis, a security auditing tool. The license key could be obtained by simple observation of the process list when a data upload is being performed. For Debian 8...

CISOfy Lynis Competitive Conditions Issue Vulnerability

CISOfy Lynis is a system security auditing tool from CISOfy Netherlands that supports multiple platforms. A Competing Conditions Issue vulnerability exists in CISOfy Lynis versions prior to 3.0.0. An attacker could exploit the vulnerability to bypass symbolic link checks and manipulate data in lo...

Security Bulletin: Information disclosure vulnerability in WebSphere Application Server (CVE-2019-4477)

Summary There is an information disclosure in WebSphere Application Server when using Security Auditing. Vulnerability Details CVEID: CVE-2019-4477 DESCRIPTION: IBM WebSphere Application Server could allow a user with access to audit logs to obtain sensitive information, caused by improper handli...