CVE-2021-21325

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 a new budget type can be defined by user. This input is not correctly filtered. This results in a cross-site scripting...

CVE-2021-21326

CVE-2021-21326 – GLPI : A horizontal privilege escalation existed in GLPI before version 9.5.4, where an attacker could use the self-service interface to create tickets for another user without enabling the delegatee system. The issue is fixed in GLPI 9.5.4. This CVE is documented with remediatio...

Cross site scripting

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI from version 9.5.0 and before version 9.5.4, there is a cross-site scripting injection vulnerability when using ajax/kanban.php. This is fixed...

Vulners Linux Audit API for Host Vulnerability Detection: Manual Auditing, Python Scripting and Licensing

Hello everyone! This episode will be about Vulners Linux Audit API, which allows you to detect vulnerabilities on a Linux host knowing only the OS version and installed packages. I had a similar post about this 4 years ago, but some details have changed, so I came back to this topic. Manual Audit...

Opmantek Open-AudIT cross-site scripting vulnerability (CNVD-2021-10491)

Open-AudIT is a network auditing application, based on the scripting languages PHP, Bash and VBScript, that tells you what's on your network, how it's configured, and if any changes have been made. A cross-site scripting vulnerability exists in Open-AudIT 4.0.1. An attacker can exploit this...

How to Audit Password Changes in Active Directory

Today's admins certainly have plenty on their plates, and boosting ecosystem security remains a top priority. On-premises, and especially remote, accounts are gateways for accessing critical information. Password management makes this possible. After all, authentication should ensure that a user ...

Unified SaaS Application Security, Detection, and Response

Organizations are rapidly embracing Software as a Service SaaS applications for scalability, ease & flexibility of use, and the benefits of not using their own infrastructure. To maintain their focus on business objectives during the new ‘remote workforce normalcy’, organizations have fast-tracke...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Kernel: x86_32: BUG in syscall auditing

A flaw was found in the Linux kernel’s system-call auditing supportCONFIGAUDITSYSCALL for 32-bit platforms. It is vulnerable to a crash caused by erroneous handling of bad system call numerals. This issue occurs during syscall2 calls if system-call auditing is enabled on the system. This flaw...

Tree-Tracker: Auditing a Log Harvest Using IoT Edge Connect and Node-Red

At long last, Blue Water Farm is generating revenue! Around 20 acres of our land consists of dense, mature hardwood of oak, maple, and beech, and we were able to contract to sell 65 maple and 25 oak trees to a logging company. I won't be retiring from Akamai any time soon from our logging windfal...

Hgiga MailSherlock SQL注入漏洞

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. HGiga MailSherlock suffers from a SQL injection vulnerability. An attacker can exploit this vulnerability to inject and execute SQL commands in URL parameters...

Zammad Access Control Error Vulnerability

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

Design/Logic Flaw

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

CVE-2020-29160

CVE-2020-29160 affects Zammad before 3.5.1. A REST API call can modify Ticket Article data and defeat auditing via an access-control flaw, with no authentication required in CVSS terms. Impact is integrity loss (high) and auditing bypass. Remediation stated across sources is to upgrade to Zammad ...

CVE-2020-29160

An issue was discovered in Zammad before 3.5.1. A REST API call allows an attacker to change Ticket Article data in a way that defeats auditing...

Zammad 安全漏洞

Zammad is a Web-based open source helpdesk/customer support system. An access control error vulnerability exists in Zammad versions prior to 3.5.1. An attacker can exploit this vulnerability to bypass auditing and change Ticket Article data via REST API calls...

Wynis - Audit Windows Security With Best Practice

Just a powershell scripts for auditing security with CIS BEST Practices Windows 10 and Window Server 2016 You just need to run the script, it will create a directory named : AUDITCONF%DATE% The directory output will contain the files belows: -Antivirus-%COMPUTERNAME% : List installed Antivirus...

"You cannot logon to the specified server" error when login to Storefront server.

Only certain users cannot log on to storefront. Following events can be seen on the storefront server : Security events logs : Event 4625, Microsoft Window security auditing Failure Information : Failure Reason : User not allowed to logon at this computer. Status : 0xC000006E Citrix Delivery...