228 matches found
The CIS Critical Security Controls Explained - Control 2: Inventory of Authorized and Unauthorized Software
As I mentioned in our last post, the 20 critical controls are divided into System, Network, and Application families in order to simplify analysis and implementation. This also allows partial implementation of the controls by security program developers who aren't building a program from scratch,...
LUNAR - Lockdown UNix Auditing and Reporting
A UNIX security auditing tool based on several security frameworks Introduction This scripts generates a scored audit report of a Unix host's security. It is based on the CIS and other frameworks. Where possible there are references to the CIS and other benchmarks in the code documentation. Why a...
Docker Compliance Check
Runs the Docker Compliance Check. These tests are inspired by the CIS Docker Benchmark. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...
Using CIS Controls To Stop Your Network From Falling in With the Wrong Crowd
Earlier this month Kyle Flaherty wrote a post on the Rapid7 Community Blog about how Rapid7 came out on top for coverage of the Center for Internet Security CIS Top 20 Security Controls. In light of recent DDoS events Id like to take a little time to discuss at a high level what the controls are,...
Lynis 2.3.0 - Security Auditing Tool for Unix/Linux Systems
We are excited to announce this major release of auditing tool Lynis. Several big changes have been made to core functions of Lynis. These changes are the next of simplification improvements we made. There is a risk of breaking your existing configuration. Lynis is an open source security auditin...
drchrono: node.drchrono.com - Information Disclosure and Windows Host Exposed
This host has the following TCP ports open; 21 - FTP 22 - SSH 135 - Windows RPC Dynamic 445 - Microsoft DS 3389 - Remote Desktop 5986 - PowerShell Remoting 47001 - WinRM The server appears to be secured well on the whole. However the services SSH and FTP do all give out some information. Please s...
Microsoft Kernel-Mode Drivers Privilege Elevation Vulnerabilities (3158222)
This host is missing an important security update according to Microsoft Bulletin MS16-062. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
CVE-2016-1343
Cisco Information Server (CIS) 6.2 is affected by an XML External Entity (XXE) vulnerability in the XML parser, where external entity declarations combined with an entity reference can allow remote attackers to read arbitrary files or cause a denial of service (CPU/memory). Exploitation details a...
DbDat - Db Database Assessment Tool
DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...
Database Assessment Tool: DbDat
DbDat performs numerous checks on a database to evaluate security. The categories of checks performed are configuration, privileges, users, and information. Checks are performed by running queries or reading database configuration files. The goal of this tool is to highlight issues that need...
CIS Manager CMS 2015Q4 SQL Injection Vulnerability
CIS Manager Content Management System 2015Q4 suffers from a remote SQL injection vulnerability. Document Title: =============== CIS Manager Content Management System 2015Q4 - SQL Injection Vulnerability Product & Service Introduction: =============================== The Constructive Internet...
CIS Manager CMS 2015Q4 SQL Injection
Document Title: =============== CIS Manager Content Management System 2015Q4 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1652 Release Date: ============= 2015-11-25 Vulnerability Laboratory ID VL-ID:...
CIS Manager CMS 2015Q4 - SQL Injection Vulnerability
Document Title: =============== CIS Manager CMS 2015Q4 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1652 Release Date: ============= 2015-11-25 Vulnerability Laboratory ID VL-ID: ==================================== 1652...
CIS Manager CMS 2015Q4 - SQL Injection Vulnerability
Document Title: =============== CIS Manager CMS 2015Q4 - SQL Injection Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1652 Release Date: ============= 2015-11-25 Vulnerability Laboratory ID VL-ID: ==================================== 1652...
CIS Manager CMS - SQL Injection
No description provided by source. + Sql Injection on CIS Manager CMS + Date: 01/04/2014 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.construtiva.com.br/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: default.asp + Dork :...
CIS WebServer 3.5.13 Remote Directory Traversal Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/12662/info A vulnerability has been identified in the handling of certain types of requests by CIS WebServer. Because of this, it is possible for an attacker to gain access to potentially sensitive system files. The probl...
Construtiva CIS Manager CMS POST SQLi
TL;DR; ====== . PRODUCT : Construtiva CIS Manager . TYPE : SQLi http://site/autenticar/lembrarlogin.asp POST email . CVE : CVE-2014-3749 Software Description ==================== . The CIS Manager platform is a complete and powerful tool to manage sites and corporative portals on the Internet. Th...
CIS Manager 'email' Parameter SQL Injection Vulnerability
CIS Manager is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
