Authorization Bypass

openssh is vulnerable to authorization bypass. The vulnerability exists as a flaw was found in the way the ssh server wrote account names to the audit subsystem. An attacker could inject strings containing parts of audit messages, which could possibly mislead or confuse audit log parsing tools...

CVE-2019-10165

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources...

Update Rollup 11 for System Center 2012 R2 Operations Manager

Update Rollup 11 for System Center 2012 R2 Operations Manager Introduction This article describes the issues that are fixed in Update Rollup 11 for Microsoft System Center 2012 R2 Operations Manager. It also contains the installation instructions for this update. Issues that are fixed in this...

Turning collaboration and customer engagement up with a strong identity approach

In these challenging times, it’s even more apparent that modern companies are managing a blended workforce that encompasses not only their full-time staff and customers but also their contractors, consultants, subsidiaries, suppliers, partners, and soon-to-be customers. Balancing friction-less...

Nsauditor 3.2.0.0 - 'Name' Denial of Service (PoC)

Exploit Title: Nsauditor 3.2.0.0 - 'Name' Denial of Service PoC Discovery by: 0xMoHassan Date: 2020-04-04 Vendor Homepage: http://www.nsauditor.com Software Link: http://www.nsauditor.com/downloads/nsauditorsetup.exe Tested Version: 3.2.0.0 Vulnerability Type: Denial of Service DoS Local Tested o...

InQL Scanner - A Burp Extension For GraphQL Security Testing

A security testing tool to facilitate GraphQL technology security auditing efforts. InQL can be used as a stand-alone script, or as a Burp Suite extension. InQL Stand-Alone Running inql from Python will issue an Introspection query to the target GraphQL endpoint in order fetch metadata informatio...

CloudBees Jenkins Audit Trail plugin cross-site scripting vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Audit Trail Plugin is used in one of the audi...

[SECURITY] Fedora 32 Update: sudo-1.9.0-0.1.b1.fc32

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

Design/Logic Flaw

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

CVE-2019-19756

CVE-2019-19756 affects Lenovo XClarity Administrator (LXCA) version 2.6.0 during Windows driver updates. A security audit found Windows OS credentials were written in plaintext to a log file, with access limited to authorized FFDC/service logs on LXCA. Documented impact is information disclosure ...

Linux: Read /etc/audit/audit.rules (KB)

audit.rules is a file containing audit rules that will be loaded by the audit daemons init script whenever the daemon is started. The auditctl program is used by the initscripts to perform this operation. The syntax for the rules is essentially the same as when typing in an auditctl command at a...

CVE-2020-2140

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2140

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability...

Cross site scripting

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2140

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability...

CVE-2020-2140

CVE-2020-2140 affects Jenkins Audit Trail Plugin (versions 3.2 and earlier). The vulnerability is a reflected cross-site scripting due to improper escaping in the URL Patterns field form validation. Exploitation could allow injection of malicious scripts via the error message. The issue is docume...

CVE-2020-2140

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability...

PT-2020-15351 · Jenkins · Jenkins Audit Trail Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Audit Trail Plugin versions 3.2 and earlier Description: The issue is related to a reflected cross-site scripting vulnerability. It occurs because the error message for the URL Patterns field form validation is not properly escaped...