Weak Password Vulnerability in Wheaton's Network Security Audit System

Shenzhen Wheaton Information Technology Co., Ltd. is committed to providing the government, enterprises and institutions with eDigital Remote Application Centralized Access Solution, eDigital VPN Secure Interconnection Solution, eDigital Core Data Security Protection Solution, eDigital Applicatio...

Smogcloud - Find Cloud Assets That No One Wants Exposed

Find exposed AWS cloud assets that you did not know you had. A comprehensive asset inventory is step one to any capable security program. We made smogcloud to enable security engineers, penetration testers, and AWS administrators to monitor the collective changes that create dynamic and ephemeral...

Weak Password Vulnerability in NetSense SecFox Security Audit System

SecFox Security Audit System is a security audit system of NetShen Information Technology Beijing Co. A weak password vulnerability exists in NetShen SecFox Security Audit System, which can be exploited by attackers to obtain sensitive information...

[SECURITY] Fedora 34 Update: tracker3-3.1.0~rc-1.fc34

Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. It consists of a common object database that allows entities to have an almost infinite number of properties, metadata both embedded/harvested as well as user definable, a comprehensive...

HGiga MailSherlock SQL Injection Vulnerability (CNVD-2021-25618)

Hgiga MailSherlock is a set of enterprise mail audit system from Henderson Hgiga, China. HGiga MailSherlock suffers from a SQL injection vulnerability, which stems from the lack of validation of externally entered SQL statements in database-based applications, and can be exploited by an attacker ...

PT-2021-19229 · Unknown · Jwt Library +1

Name of the Vulnerable Software and Affected Versions: NATS Server versions 2.0.0 through 2.1.9 JWT library versions prior to 2.0.1 Description: The issue is related to Incorrect Access Control in the NATS server and JWT library. The validation of Import token bindings incorrectly warns on...

CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

CVE-2021-3417

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

Design/Logic Flaw

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

CVE-2021-3417

An internal product security audit of LXCO, prior to version 1.2.2, discovered that credentials for Lenovo XClarity Administrator LXCA, if added as a Resource Manager, are encoded then written to an internal LXCO log file each time a session is established with LXCA. Affected logs are captured in...

CVE-2021-3417

Lenovo XClarity Orchestrator (LXCO) prior to 1.2.2 stores LXCA credentials in internal logs: when LXCA is added as a Resource Manager, credentials are encoded and written to the FFDC/service log, which is only accessible to the privileged LXCO user who requested the file. No exploitation details ...

CVE-2020-8356

An internal product security audit of LXCO, prior to version 1.2.2, discovered that optional passwords, if specified, for the Syslog and SMTP forwarders are written to an internal LXCO log file in clear text. Affected logs are captured in the First Failure Data Capture FFDC service log. The FFDC...

CVE-2020-8356

CVE-2020-8356 concerns Lenovo XClarity Orchestrator (LXCO) prior to version 1.2.2. The vulnerability arises because optional passwords for Syslog and SMTP forwarders are written in clear text to an internal LXCO log file; affected logs are captured in the FFDC service log. The FFDC log is generat...

kernel: bad kfree in auditfilter.c may lead to escalation of privilege

A flaw was found in the Linux kernel. A logic error in auditdatatoentry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to da...

kernel: bad kfree in auditfilter.c may lead to escalation of privilege

A flaw was found in the Linux kernel. A logic error in auditdatatoentry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to da...

kernel: bad kfree in auditfilter.c may lead to escalation of privilege

A flaw was found in the Linux kernel. A logic error in auditdatatoentry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to da...

CVE-2020-35501

A flaw was found in the Linux kernels implementation of audit rules, where a syscall can unexpectedly not be correctly not be logged by the audit subsystem Mitigation This syscall can still be audited by using the syscall auditing feature by passing openbyhandleat to it in the rule. Existing...

Python -- multiple vulnerabilities

Python reports: bpo-43434: Creating a sqlite3.Connection object now also produces a sqlite3.connect auditing event. Previously this event was only produced by sqlite3.connect calls. Patch by Erlend E. Aasland. bpo-43882: The presence of newline or tab characters in parts of a URL could allow some...

kernel: bad kfree in auditfilter.c may lead to escalation of privilege

A flaw was found in the Linux kernel. A logic error in auditdatatoentry can lead to a local escalation of privilege without user interaction needed. A local attacker with special user privilege could crash the system leading to information leak. The highest threat from this vulnerability is to da...