CVE-2022-24867

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldappass is not filtered and when you look at the source code of the...

CVE-2022-24868 Cross site scripting via SVG file upload in GLPI

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user...

CVE-2022-24867

GLPI (Asset & IT Management Software) has a CVE-2022-24867 issue where, when passing config to the JavaScript, the ldap_pass variable is not filtered and the root DN password is exposed in the rendered page source. This is a data exposure flaw in the authentication/config handling path. The advis...

CVE-2022-24867 LDAP password exposure in glpi

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldappass is not filtered and when you look at the source code of the...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a system call that is not properly logged by the auditing subsystem...

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections By Taylor Mullins · March 23, 2022 Trellix is continuing to monitor the threat activity related to the LAPSUS$ threat group and their recent breaches of large organizations such as NVIDIA, Samsung, Microsoft, and Okta. This...

ZOHO ManageEngine SharePoint Manager Plus权限提升漏洞

ZOHO ManageEngine SharePoint Manager Plus is a complete management and auditing solution from ZOHO, Inc. An elevation of privilege vulnerability exists in versions of ZOHO ManageEngine SharePoint Manager Plus prior to 4329, which could be exploited by an attacker to cause sensitive data to be...

Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2022-1097)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-24975

The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option. Note: This has been disputed by...

Mageia: Security Advisory (MGASA-2014-0316)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

IBM Security Guardium Insights输入验证错误漏洞

IBM Security Guardium Insights is a data security solution from IBM Corporation. The product supports data analytics, threat alerts, data security auditing and local data monitoring. IBM Security Guardium Insights has an input validation error vulnerability in v3.0, which stems from the fact that...

Exploit for CVE-2021-28476

CVE-2021-28476: Hyper-V vmswitch.sys arbitrary pointer derefer...

Opmantek Open-AudIT Path Traversal Vulnerability

Opmantek Open-AudIT is an open source network discovery and auditing program from Opmantek, Inc. The program intelligently scans networks and network devices and provides status reports.Opmantek Open-AudIT suffers from a path traversal vulnerability that can be exploited by attackers to read file...

SAILFISH System to Find State-Inconsistency Bugs in Smart Contracts

A group of academics from the University of California, Santa Barbara, has demonstrated what it calls a "scalable technique" to vet smart contracts and mitigate state-inconsistency bugs, discovering 47 zero-day vulnerabilities on the Ethereum blockchain in the process. Smart contracts are program...

Command Execution Vulnerability in Opmantek Open-AudIT

Opmantek Open-AudIT is a network auditing program based on PHP, bash shell and VB language. Opmantek Open-AudIT suffers from a command execution vulnerability that can be exploited by a remote attacker to submit a special request and execute a command...

Cross-Site Request Forgery (CSRF) in splitbrain/dokuwiki

Description Auditing the AJAX endpoints revealed that some endpoints which perform state-changes do not have CSRF protection. Proof of Concept POST /lib/exe/ajax.php?call=draftdel&id=start Impact This vulnerability is capable of tricking users to delete their own drafts...

SMBeagle - Fileshare Auditing Tool That Hunts Out All Files It Can See In The Network And Reports If The File Can Be Read And/Or Written

SMBeagle is an SMB fileshare auditing tool that hunts out all files it can see in the network and reports if the file can be read and/or written. All these findings are streamed out to either a CSV file or an elasticsearch host, or both!? SMBeagle tries to make use of the win32 APIs for maximum...

Amzetta Technologies AmZetta zPortal DVM Integer Overflow Vulnerability

Amzetta Technologies Amzetta Zportal is a virtual desktop and application controller from Amzetta Technologies, Inc. It is used by administrators to create and manage hosted applications, virtual desktops, shared hosted desktops, and auditing services, provide resources for virtual desktops, prox...

RHEL 6 : kernel (RHSA-2021:0181)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0181 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: Kernel: x8632: BUG in syscall auditing...

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to...