Design/Logic Flaw

In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file...

CVE-2021-31906

CVE-2021-31906 affects JetBrains TeamCity prior to 2020.2.2. The issue is that audit logs were not sufficient when an administrator uploaded a file, leading to potential information disclosure implied by insufficient logging. Exploitation details are not provided in the supplied documents, and th...

CVE-2021-31906

In JetBrains TeamCity before 2020.2.2, audit logs were not sufficient when an administrator uploaded a file...

Jetbrains JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains Jetbrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in...

Use safeTransfer/safeTransferFrom consistently instead of transfer/transferFrom

Handle 0xRajeev Vulnerability details Impact It is good to add a require statement that checks the return value of token transfers or to use something like OpenZeppelin’s safeTransfer/safeTransferFrom unless one is sure the given token reverts in case of a failure. Failure to do so will cause...

Unauthorized Access Vulnerability in the Operations and Maintenance Audit System of Xinhua San Technologies Co.

Xinhua San Technology Co., Ltd. is committed to becoming the most reliable partner for customers' business innovation and digital transformation. The main products are routers, big data, switches, IoT, cloud computing, servers and so on. An unauthorized access vulnerability exists in the Operatio...

Red-Detector - Scan Your EC2 Instance To Find Its Vulnerabilities Using Vuls.io

Scan your EC2 instance to find its vulnerabilities using Vuls https://vuls.io/en/. Audit your EC2 instance to find security misconfigurations using Lynis https://cisofy.com/solutions/lynis. Scan your EC2 instance for signs of a rootkit using Chkrootkit http://www.chkrootkit.org/. Requirements 1...

KubeArmor - Container-aware Runtime Security Enforcement System

Introduction to KubeArmor KubeArmor is a container-aware runtime security enforcement system that restricts the behavior such as process execution, file access, networking operation, and resource utilization of containers at the system level. KubeArmor operates with Linux security modules LSMs,...

The vulnerability of the Oracle Database - Enterprise Edition Unified Audit component of the Oracle Database Server system allows a perpetrator to gain access to modify, add, or delete data.

The vulnerability of the Oracle Database - Enterprise Edition Unified Audit component of the Oracle Database Server system is related to access boundary deficiencies. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data using the Oracle Net network...

FreeBSD : Python -- multiple vulnerabilities (bffa40db-ad50-11eb-86b8-080027846a02)

Python reports : bpo-43434: Creating a sqlite3.Connection object now also produces a sqlite3.connect auditing event. Previously this event was only produced by sqlite3.connect calls. Patch by Erlend E. Aasland. bpo-43882: The presence of newline or tab characters in parts of a URL could allow som...

Audit Log Request Bypass

HashiCorp Consul Enterprise is bypassing audit-logging request. It is possible because it does not parse endpoint URL to prevent requests from bypassing the audit log...

Invoke-Stealth - Simple And Powerful PowerShell Script Obfuscator

Invoke-Stealth is a Simple & Powerful PowerShell Script Obfuscator. This tool helps you to automate the obfuscation process of any script written in PowerShell with different techniques. You can use any of them separately, together or all of them sequentially with ease, from Windows or Linux...

GitHub Missing Audit Logging

Original blog post here: https://wwws.nightwatchcybersecurity.com/2021/04/25/supply-chain-attacks-via-github-com-releases/ SUMMARY Release functionality on GitHub.com allows modification of assets within a release by any project collaborator. This can occur after the release is published, and...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plug-in). Supported versions that are affected are 5.7.33 and prior and 8.0.23 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized update insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).

...

Command Execution Vulnerability in Renzihang Cloud Ops Security Audit System

RENZHOU Cloud O&M Security Audit System is a powerful support platform for enterprise and public utility IT systems' internal pre-prevention, mid-monitoring, and post-auditing. A command execution vulnerability exists in RENZIHANG Cloud O&M Security Audit System, which can be exploited by attacke...

Bypass of Kubernetes API Server proxy TOCTOU

CVSS Rating: Low CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N A security issue was discovered in Kubernetes where an authorized user may be able to access private networks on the Kubernetes control plane components. Kubernetes clusters are only affected if an untrusted user can create or modify...

Critical RCE Bug Found in Homebrew Package Manager for macOS and Linux

A recently identified security vulnerability in the official Homebrew Cask repository could have been exploited by an attacker to execute arbitrary code on users' machines that have Homebrew installed. The issue, which was reported to the maintainers on April 18 by a Japanese security researcher...

Command Execution Vulnerability in Renzi Audit Gateway

Ltd. is the most comprehensive provider of large-scale cyberspace security protection solutions in China. A command execution vulnerability exists in the Renzihang Audit Gateway, which can be exploited by an attacker to execute arbitrary commands...

SQL Injection Vulnerability in Budget Instant Audit System of Beijing Zhongke Shangxin Technology Co.

Ltd. is the pioneer of comprehensive budget informatization solution for domestic enterprises, creating enterprise financial management platform software and mobile reimbursement bill of lading. A SQL injection vulnerability exists in the Budget Instant Audit System of Beijing Zhongke Shangxin...

CVE-2021-2245

Vulnerability in the Oracle Database - Enterprise Edition Unified Audit component of Oracle Database Server. Supported versions that are affected are 18c and 19c. Easily exploitable vulnerability allows high privileged attacker having Create Audit Policy privilege with network access via Oracle N...