kibana: Audit logging Remote Code Execution issue

An arbitrary code execution flaw was found in Kibana in versions prior to 5.6.15 and 6.6.1. If a Kibana instance has the setting xpack.security.audit.enabled set to true, an attacker could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executi...

Kube-Alien - Tool To Launches Attack on K8s Cluster from Within

This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys file by...

RHEL 7 : OpenShift Container Platform 4.1.18 (RHSA-2019:2860)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2019:2860 advisory. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or privat...

Spoofing

An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB Storage Block BMC in firmware versions prior to 1908.M. This vulnerability allows session IDs to be reused, which could provide unauthorized access to the BMC under certain...

Empower your Cloud Ops Teams – Publish Qualys CloudView Security Assessment Reports to their Slack Channel

In today’s constantly changing and evolving cloud environments, being able to quickly provide information on misconfigurations and security policy violations in your cloud accounts and assets has become a critical need to the success of your security operations. Many cloud platforms offer tools...

Weak Password Vulnerability in Mingguo Comprehensive Log Audit Platform of Hangzhou Anheng Information Technology Co.

MingGuard Integrated Log Audit Platform is a comprehensive management platform as an information system. There is a weak password vulnerability in Mingguo Comprehensive Log Audit Platform of Hangzhou ACE Information Technology Co., Ltd, which can be exploited by an attacker to log in to the syste...

Weak Password Vulnerability in Mingguo Database Audit and Risk Control System of Hangzhou ACE Information Technology Co.

The Meiji Database Audit and Risk Control System is a database protocol parsing device, capable of parsing the access traffic to and from the core database at the datagram field level. There is a weak password vulnerability in the database audit and risk control system of Hangzhou ACE Information...

Weak Password Vulnerability in NetGuard Network Audit System V3.0 of Beijing NetGuard Nebula Information Technology Co.

Netnifty Network Audit System Operation and Maintenance Security Control Type is one of Netnifty's comprehensive internal control series products. It is a compliance control system that controls and audits user operation and maintenance operations in the business environment. Netnifty Network Aud...

CVE-2019-4477

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line options. IBM X-Force ID: 163997...

CVE-2019-4477

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line options. IBM X-Force ID: 163997...

CVE-2019-4477

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a user with access to audit logs to obtain sensitive information, caused by improper handling of command line options. IBM X-Force ID: 163997...

CVE-2019-4477

CVE-2019-4477 affects IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0. The described vulnerability is information disclosure caused by improper handling of command line options, enabling a user with audit-log access to obtain sensitive information. Connected IBM bulletins confirm the vuln...

PT-2019-17100 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 7.0 through 9.0 Description: The issue allows a user with access to audit logs to obtain sensitive information due to improper handling of command line options. Recommendations: For IBM WebSphere...

CVE-2019-16293

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

CVE-2019-16293

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

Design/Logic Flaw

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

CVE-2019-16293

Open-AudIT is affected by CVE-2019-16293 for versions prior to 3.2.0. The issue arises in the Create Discoveries feature, allowing an authenticated attacker to execute arbitrary OS commands by injecting a crafted value into a URL field. The Red Hat advisory confirms the same description. The avai...

CVE-2019-16293

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

Weak Password Vulnerability in the System-Log Audit System of Taihe Information Security Operation Center of Beijing Qixingchen Information Security Technology Co.

TAICHI Information Security Operation Center System - Log Audit System TSOC-SA, TSOC-SA is capable of real-time collection of logs, events, alarms and other information generated by security devices, network devices, hosts, operating systems, and various application systems from different vendors...

Airgeddon v9.21 - A Multi-use Bash Script for Linux Systems to Audit Wireless Networ

This is a multi-use bash script for Linux systems to audit wireless networks. All the needed info about how to "install | use | enjoy" airgeddon is present at Github's Wiki. I. Content & Features Home Features Screenshots Wallpapers II. Requirements Requirements Compatibility Essential Tools...