After Upgrade to WEM 4.6 agents not getting configurations with error: Agent (Agent name) is not bound to any configuration set

Upgrade WEM environment from 4.5 to 4.6. After upgrading, WEM agents are randomly reported with the following different status under Administration Agents Registrations: "Agent is bound to multiple configuration sets." Then the same agents are reported with the following status: "Agent is not be...

New FastTrack benefit: Deployment support for Co-management on Windows 10 devices

This blog is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 security solutions. In this series youll find context, answers, and guidance for deployment and driving adoption within your organization. Check out our last blog Getting th...

Security Bulletin: Samba vulnerability issue on SONAS (CVE-2013-4408 and CVE-2012-6105)

Summary An attacker could gain privileged access to SONAS system by exploiting a vulnerability in Samba. Vulnerability Details CVE ID: CVE-2013-4408 and CVE-2012-6105 DESCRIPTION: This issue affects only those SONAS systems that use Active Directory server for authentication. Configuration with...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-4408 and CVE-2012-6105)

Summary An attacker could gain privileged access to IBM Storwize V7000 Unified system by exploiting a vulnerability in Samba. Vulnerability Details CVE ID: CVE-2013-4408 and CVE-2012-6105 DESCRIPTION: This issue affects only those IBM Storwize V7000 Unified systems that use Active Directory serve...

Security Bulletin: IBM Security Identity Manager Adapters passwords exposed in log files (CVE-2014-8923)

Summary It is possible to configure IBM Security Identity Manager Active Directory Adapter for Windows in such a way that the logging of certain activities could result in the log files containing passwords that are in clear text Vulnerability Details CVEID: CVE-2014-8923 DESCRIPTION: IBM Securit...

RiskySPN - Detect And Abuse Risky SPNs

RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs Service Principal Name. This module can assist blue teams to identify potentially risky SPNs as well as red teams to escalate privileges by leveraging Kerberos and Active Directory. For...

Microsoft Windows: Presence of LAPS AdmPwd GPO Extension / CSE

This test checks the presence of LAPS AdmPwd GPO Extension / CSE on Windows hosts at least Windows 8.1. The Local Administrator Password Solution LAPS tool, which is free and supported software that allows an organization to automatically set randomized and unique local Administrator account...

CVE-2018-10509

A vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a attacker to exploit it via a Browser Refresh attack on vulnerable installations. An attacker must be using a AD logon user account in order to exploit this vulnerability...

CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is...

Design/Logic Flaw

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is...

CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is...

CVE-2018-12089

In Octopus Deploy version 2018.5.1 to 2018.5.7, a user with Task View is able to view a password for a Service Fabric Cluster, when the Service Fabric Cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. This is...

CVE-2018-12089

In Octopus Deploy versions 2018.5.1–2018.5.7 , a user with Task View could view a Service Fabric Cluster password when the cluster target is configured in Azure Active Directory security mode and a deployment is executed with OctopusPrintVariables set to True. Root cause: potential disclosure due...

Microsoft Windows: Network access: Restrict clients allowed to make remote calls to SAM

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winnaclientsallowedremotesam.nasl 11098 2018-08-23 14:32:47Z emoss $ Check value for Network access: Restrict clients allowed to make remote calls to SAM Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks...

New Relic: Insecure Infrastructure Integrations YML Loading leads to Windows Privilege Escalation

After installing the Windows Infrastructure client as discussed in https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/installation/install-infrastructure-windows-server I noticed that integration yml config files are not only loaded from the folder within Program Files, but al...

ManageEngine ADAudit Plus Detection (HTTP)

HTTP based detection of ManageEngine ADAudit Plus. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

May 23, 2018—KB4100403 (OS Build 17134.81)

None None...

CVE-2018-10327

PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cpsconfig.xml file...

Directory traversal

PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cpsconfig.xml file...

CVE-2018-10327

PrinterOn Enterprise 4.1.3 stores the Active Directory bind credentials using base64 encoding, which allows local users to obtain credentials for a domain user by reading the cpsconfig.xml file...