GHSA-3M86-C9X3-VWM9 Graylog vulnerable to privilege escalation through API tokens

Impact Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID. For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests ...

CVE-2023-23487

IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918...

CVE-2022-2366

Incorrect default configuration for trusted IP header in Mattermost version 6.7.0 and earlier allows attacker to bypass some of the rate limitations in place or use manipulated IPs for audit logging via manipulating the request headers...

CVE-2021-28131

Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, therefore Impala users with access to the logs can use another authenticated user's sessions with specially constructed requests. This means the...

CVE-2019-10084

In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization and audit mechanisms. Session and query IDs are unique an...

CVE-2009-5002

The Workplace aka WP component in IBM FileNet P8 Application Engine P8AE 4.0.2.x before 4.0.2.1-P8AE-FP001 does not record Get Content Failure Audit events, which might allow remote attackers to attempt content access without detection...

Engineering Risk-Aware, Security-By-Design Frameworks for Assurance of Large-Scale Autonomous AI Models

As AI models scale to billions of parameters and operate with increasing autonomy, ensuring their safe, reliable operation demands engineering-grade security and assurance frameworks. This paper presents an enterprise-level, risk-aware, security-by-design approach for large-scale autonomous AI...

Configure the SSH Service Log Level Properly

SSH provides multiple log output levels, such as QUIET, FATAL, ERROR, INFO, VERBOSE, DEBUG, DEBUG1, DEBUG2, and DEBUG3. A higher log level such as QUIET or FATAL prints less log information. This saves drive space but hinders administrators from auditing and tracing SSH events. Conversely, a lowe...

Correctly Configure the Log Records of Each Service

Logs should be configured so that important system behaviors and security-related information are recorded by rsyslog. The configuration files /etc/rsyslog.conf and /etc/rsyslog.d/.conf specify the rules for logging and the files for recording specific types of logs. If logging is not configured,...

Security Bulletin: A vulnerability in IBM Spectrum Scale could allow a local attacker to bypass the filesystem audit logging (CVE-2021-29671)

Summary A security vulnerability has been identified in IBM Spectrum Scale FAL that could allow a local attacker to bypass the FAL mechanism. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2021-29671 DESCRIPTION: IBM Spectrum Scale could allow a local attacker to bypas...

PT-2024-16600 · Opentext · Opentext Secure Content Manager

Name of the Vulnerable Software and Affected Versions: OpenText Secure Content Manager versions 10.1 through 24.3 Description: The issue is related to insufficient logging in OpenText Secure Content Manager on Windows, allowing audit log manipulation. This could potentially lead to undetected...

CVE-2024-48967

The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings...

CVE-2024-48967 Life2000 ventilator and Service PC lack sufficient audit logging capabilities

The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings...

CVE-2024-48967

The CVE-2024-48967 entry concerns Baxter Life2000 ventilator and associated Service PC, where inadequate audit logging prevents detection of malicious activity. The description states that an attacker with access could alter ventilator settings without detection, leading to unauthorized informati...

CVE-2024-48967 Life2000 ventilator and Service PC lack sufficient audit logging capabilities

The ventilator and the Service PC lack sufficient audit logging capabilities to allow for detection of malicious activity and subsequent forensic examination. An attacker with access to the ventilator and/or the Service PC could, without detection, make unauthorized changes to ventilator settings...

Baxter Life2000 安全漏洞

The Baxter Life2000 is a mask-less non-invasive ventilator from Baxter. A security vulnerability exists in Baxter Life2000 version 06.08.00.00 and prior versions, which stems from the lack of sufficient audit logging functionality to detect malicious activity and perform subsequent forensic...

PT-2024-33303 · Unknown · Service Pc +1

Name of the Vulnerable Software and Affected Versions: Ventilator and Service PC affected versions not specified Description: The ventilator and the Service PC lack sufficient audit logging capabilities, making it difficult to detect malicious activity and conduct forensic examinations. An attack...

Security update for 389-ds

This update for 389-ds fixes the following issues: Persist extracted key path for ldapsslclientinit over repeat invocations bsc1230852 Re-enable use of .dsrc basedn for dsidm commands bsc1231462 Update to version 2.2.10git18.20ce9289: RFE: Use previously extracted key path Update dsidm to...

CVE-2023-22649

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue...

BEC-ware the phish (part 1). Investigating incidents in M365

TL;DR Review the key artefacts to ensure the best possible telemetry is available in the case of a Business Email Compromise BEC. Keep an eye on data retention, where necessary export or forward data for investigations longer than 30 days. Verify and enable Unified Audit Logging, its free and giv...