CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

CVE-2021-40238

A Cross Site Scriptiong XSS vulnerability exists in the admin panel in Webuzo 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs"...

Cross-Site Request Forgery (CSRF) in myvesta/vesta

✍️ Description The download/web-log endpoint does not have CSRF Protection. This could be used to force download error log and potentially sensitive information leakage. 🕵️‍♂️ Proof of Concept Login to user account. Create the following POC.html file and open the page in browser. To verify that you...

Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The plugin is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure PoC RCE through chaining LFI with log poisoning 1. Path Traversal / Local File...

Command injection

A vulnerability due to the improper handling of direct memory access DMA buffers on EX4300 switches on Juniper Networks Junos OS allows an attacker sending specific unicast frames to trigger a Denial of Service DoS condition by exhausting DMA buffers, causing the FPC to crash and the device to...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

Citrix WEM Agent Host Service Initialization failed - event id 0

Wem Agent fails to start - in the event log we see the error: Event id 0 - Agent host Service Initialization Failed...

UBUNTU-CVE-2021-25284

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level...

PYSEC-2021-53

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level...

Saltstack SaltStack Salt 安全漏洞

SaltStack Salt is a set of open source tools for managing infrastructure from SaltStack Saltstack. The tool provides configuration management, remote execution, and other features. A security vulnerability exists in SaltStack Salt versions prior to Salt 3002.5 that stems from the ability to log...

IBM MQ 8.0 <= 8.0.0.11 / 9.0 <= 9.0.0.6 LTS / 9.1 <= 9.1.0.1 LTS / 9.1.1 < 9.1.2 CD (870492)

The version of IBM MQ Server running on the remote host is affected by a vulnerability that allows a local attacker to cause a denial of service within the error log reporting system. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported...

MediaWiki Input Validation Error Vulnerability (CNVD-2021-38681)

MediaWiki is a set of free and freely available web-based Wiki engines from the MediaWiki Wikimedia Foundation in the United States. It can be used to deploy in-house knowledge management and content management systems. An input validation error vulnerability exists in MediaWiki versions prior to...

mysqld_safe in Oracle MySQL through 5.5.51 5.6.x through 5.6.32 and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2 5.6.x before 5.6.32-78-1 and 5.7.x before 5.7.14-8; and Percona XtraDB Cluster before 5.5.41-37.0 5.6.x before 5.6.32-25.17 and 5.7.x before 5.7.14-26.17 when using file-based logging allows local users with access to the mysql account to gain root privileges via a symlink attack on error logs and possibly other files.

...

CVE-2020-17449

PHP-Fusion 9.03 allows XSS via the errorlog file...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

MassDNS - A High-Performance DNS Stub Resolver For Bulk Lookups And Reconnaissance (Subdomain Enumeration)

MassDNS is a simple high-performance DNS stub resolver targetting those who seek to resolve a massive amount of domain names in the order of millions or even billions. Without special configuration, MassDNS is capable of resolving over 350,000 names per second using publicly available resolvers...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

cPanel Authorization Issues Vulnerability (CNVD-2019-36124)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. An authorization issue vulnerability exists in cPanel. An attacker can exploit this vulnerability to create the cpdavderrorlog fi...

Problem in taking a backup of ADC VPX from ADM

ADM is unable to take periodic backups of ADC and manual backups fail too. Here are the errors that we see in mpsconfig.log in ADM: SCP: Unable to open a session on 192.168.x.x Tuesday, 8 Oct 19 16:00:08.872 +1100 Error DeviceBackup541 Backup: Error uploading /mps/nssystembackup.pl on Citrix ADC...