WP Security Audit Log < 4.0.2 - Broken Access Control in First-Time Install Wizard

Broken access control vulnerability affecting version 4.0.1 and below that could lead to privilege escalation, sensitive data exposure and insecure deserialisation. To exploit the vulnerability, the wizard must not have been completed, otherwise it won’t work...

WordPress WP Security Audit Log plugin <= 4.0.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NinTechNet in WordPress WP Security Audit Log plugin versions = 4.0.1. Solution Update the WordPress WP Security Audit Log plugin to the latest available version at least 4.0.2...

Kibana < 5.6.15 Multiple Vulnerabilities

According to its self-reported version number, the Kibana application running on the remote host is prior to 5.6.15 or 6.x prior to 6.6.1. It is, therefore, affected by the following vulnerabilities: - A cross-site scripting XSS vulnerability that could allow an attacker to obtain sensitive...

Kibana 6.x < 6.6.1 Multiple Vulnerabilities

According to its self-reported version number, the Kibana application running on the remote host is prior to 5.6.15 or 6.x prior to 6.6.1. It is, therefore, affected by the following vulnerabilities: - A cross-site scripting XSS vulnerability that could allow an attacker to obtain sensitive...

The vulnerability of the Security Audit Log of the SAP HANA database management system allows a perpetrator to circumvent existing security restrictions.

The vulnerability of the Security Audit Log of the SAP HANA database management system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to circumvent existing security restrictions remotely...

@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-15123 +1 more via codecov (>=3.0.0, <=3.6.1)

codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-15123, CVE-2020-7597 Source advisory: OSV:GHSA-5Q88-CJFQ-G2MH...

FC Barcelona Suffers Likely Credential-Stuffing Attack on Twitter

Just ahead of its Champion’s League Round of 16 appearance next week, FC Barcelona’s official Twitter account was hacked in an apparent credential-stuffing attack. The strike resulted in account takeover and bogus tweets being sent out. The hacking collective known as OurMine, which made headline...

CVE-2019-19757

An internal product security audit of Lenovo XClarity Administrator LXCA discovered a Document Object Model DOM based cross-site scripting vulnerability in versions prior to 2.6.6 that could allow JavaScript code to be executed in the user's web browser if a specially crafted link is visited. The...

CVE-2019-19757

Lenovo XClarity Administrator (LXCA) DOM-based cross-site scripting vulnerability exists in versions prior to 2.6.6. A specially crafted link could cause JavaScript to run in the user’s browser (executed on the user’s system, not LXCA). The advisory’s remediation is to upgrade to LXCA 2.6.6 or la...

Researchers: Hackers Can Seize Control of Ballots Cast Using the Voatz Voting App

Security researchers have found key flaws in a mobile voting app that some states plan to use in the 2020 election that can allow hackers to launch both client- and server-side attacks that can easily manipulate or even delete someone’s vote, as well as prevent a reliable audit from taking place...

OSSEC-HIDS Security Audit Findings

Hi folks, I spent some free time recently auditing OSSEC. I w...

Public Bug Bounty Takes Aim at Kubernetes Container Project

A public bug-bounty program for the Kubernetes container technology framework has just launched, backed by Google, HackerOne and the Cloud Native Computing Foundation CNCF. The Kubernetes container-orchestration system was originally built by Google for automating application deployment, scaling...

Security Bulletin: IBM Security Guardium is affected by an Oracle MySQL vulnerabilities

Summary IBM Security Guardium has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2019-2789 DESCRIPTION: An unspecified vulnerability in Oracle MySQL related to the Server Server: Security: Privileges component could allow an authenticated attacker to cause no...

SYS.1.2.2.A7

Ziel des Bausteins SYS.1.2.2 ist die Absicherung von Microsoft Windows Server 2012 und Microsoft Windows Server 2012 R2. Die Standard-Anforderung Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify...

Kibana 5.x < 5.6.15 / 6.x < 6.6.1 Multiple Vulnerabilities

Binary data 701234.prm...

7-Year-Old Critical RCE Flaw Found in Popular iTerm2 macOS Terminal App

A 7-year-old critical remote code execution vulnerability has been discovered in iTerm2 macOS terminal emulator app—one of the most popular open source replacements for Mac's built-in terminal app. Tracked as CVE-2019-9535, the vulnerability in iTerm2 was discovered as part of an independent...

How Activity Logs Help WordPress Admins Better Manage Website Security

Managing a WordPress website can sap a lot of your time and energy, which otherwise you'd spend on managing your business. If you're looking to cut down on the hours, you spend troubleshooting WordPress technical and security problems, better managing and monitoring your website and users, or you...

How Activity Logs Help WordPress Admins Better Manage Website Security

Managing a WordPress website can sap a lot of your time and energy, which otherwise you'd spend on managing your business. If you're looking to cut down on the hours, you spend troubleshooting WordPress technical and security problems, better managing and monitoring your website and users, or you...

mysql: Server: Security: Audit unspecified vulnerability (CPU Jul 2019)

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Security: Audit. Supported versions that are affected are 5.6.44 and prior, 5.7.26 and prior and 8.0.16 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple...

Nextcloud: Veracode and security audit record are publicly available

Leakage of sensitive data through open endpoint Risk management and Compliance Document written by NCC Here is what the document says: 𝘗𝘳𝘰𝘱𝘳𝘪𝘦𝘵𝘢𝘳𝘺 𝘐𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯 𝘛𝘩𝘪𝘴 𝘥𝘰𝘤𝘶𝘮𝘦𝘯𝘵 𝘤𝘰𝘯𝘵𝘢𝘪𝘯𝘴 𝘥𝘦𝘵𝘢𝘪𝘭𝘦𝘥 𝘤𝘰𝘮𝘮𝘦𝘳𝘤𝘪𝘢𝘭, 𝘧𝘪𝘯𝘢𝘯𝘤𝘪𝘢𝘭 𝘢𝘯𝘥 𝘭𝘦𝘨𝘢𝘭 𝘪𝘯𝘧𝘰𝘳𝘮𝘢𝘵𝘪𝘰𝘯, 𝘸𝘩𝘪𝘤𝘩 𝘪𝘴 𝘤𝘰𝘯𝘧𝘪𝘥𝘦𝘯𝘵𝘪𝘢𝘭 𝘢𝘯𝘥 𝘤𝘰𝘮𝘮𝘦𝘳𝘤𝘪𝘢𝘭𝘭𝘺 𝘴𝘦𝘯𝘴𝘪𝘵𝘪𝘷𝘦. 𝘛𝘩𝘦 𝘳𝘦𝘭𝘦𝘢𝘴𝘦...