CVE-2017-11686

Zoho ManageEngine Event Log Analyzer (versions 11.4 and 11.5) is affected by a cross-site scripting/vulnerable cookie handling issue that allows a remote attacker to obtain an authenticated user’s password. The root cause is that the password is represented in a cookie with reversible encoding, e...

CVE-2017-11685

Affected product: Zoho ManageEngine Event Log Analyzer (versions 11.4 and 11.5). Vulnerability type / vector: Cross-site scripting (XSS) in the search and display of event data, exploitable via the fName parameter. Root cause (as stated): Multiple reflective XSS vulnerabilities enable remote atta...

Dr0p1t Framework 1.3 - A Framework That Creates An Advanced FUD Dropper With Some Tricks

Have you ever heard about trojan droppers ? In short dropper is type of trojans that downloads other malwares and Dr0p1t gives you the chance to create a stealthy dropper that bypass most AVs and have a lot of tricks! Features Generated executable properties: The executable size is smaller compar...

Failed to Promote vDisk from Remote PVS Server

Failed to promote vdisk version from remote PVS server due to error "DeviceIoControl error: A device attached to the system is not functioning." And this vDisk Remote Mount error does not prevent Promotion of a vDisk Version, which will leave the vDisk in an unusable state. Customer will encounte...

Log injection in SAP NetWeaver AS Java using basic auth

Application: SAP NetWeaver AS Java Versions Affected: ENGINEAPI 7.10-7.50 Vendor URL: SAP Bug: Log Injection Reported: 17.05.2017 Vendor response: 18.05.2017 Date of Public Advisory: 14.11.2017 Reference: SAP Security Note 2485208 Author: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...

Microsoft Malware Protection Engine RCE (CVE-2017-0290)

Natalie Silvanovich and Tavis Ormandy of Google Project Zero found a pretty nasty bug in Microsoft Malware Protection Engine, allowing an attacker to execute arbitrary code as LocalSystem on any Windows computer running any Microsoft anti-malware product such as Security Essentials or Windows...

Citrix Director: Could Not Establish Trust Relationship for the SSL/TLS Secure Channel

Director display in License Server section Cannot retrieve the data. Data source unresponsive due to configuration error. View Director server event logs for further information Checking the Application event log on the server running Director- logs event error: Event ID: 8 Level: Error Source:...

PVS Servers randomly became offline

PVS servers were randomly offline and then recover automatically. The issue could happen several times a day on different PVS server. When PVS server was offline, sometimes we saw Streamprocess event 11 logged in event log, but sometime not...

'Events data collection failure' Issue

Challenge Veeam ONE raises Events data collection failure against Veeam Backup & Replication or Hyper-V server. Cause Permissions, UAC configuration, and firewall settings need to be configured. Solution Troubleshooting Checks Verify that the account used to connect to Veeam Backup & Replication ...

Bnistack error 85 - IOS Socket UNAVAILABLE - not counting retry

Target Devices actively connected to Provisioning Services suddenly exhibit severe performance issues such as: Target completely hangs Performance is extremely slow Number of retries increases dramatically Atthe same time the following error is found in the Event Logs inside the Target Device:...

PVS Targets run chkdsk at boot after the vDisk has been modified

Every time a PVS Target Device boots from a vDisk the OS detects problems with the C: drive and automatically runs chkdsk at boot time. The following events might be observed in the Windows Event Log on the Target Device: Event Log: System Source: Ntfs Event ID: 55 Text: The file system structure...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure Vunerability

Farmer's Fridge Kiosk version 2.0.0 suffers from an unprotected event log information disclosure vulnerability as well as unauthenticated request issues. Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure

Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com Affected version: 2.0.0 Summary: Donat think of the Farmeras Fridge kiosk as a vending machine. Itas a veggie machine. And just as each salad is a culina...

Unifiltr EventID 3: Unidesk denied an attempt to rename a directory

Your software may report an error attempting to rename a directory, you may receive an error trying to move a folder to the Recycle Bin, and you may see an error in the Windows System event log on an IM that looks like this: Log Name: System Source: unifltr Date: 10/23/2013 9:58:30 PM Event ID: 3...

StoreFront SAML Troubleshooting Guide

During the installation and configuration of the SAML functionality introduced with StoreFront 3.9, there are various items to be aware of when performing a successful configuration. Although there are other issues you might encounter, this document will try to provide direction to help resolve...

Overview of Windows activation with KMS server

Sometimes after properly following the preparation steps, on start up the Operating System shows only 3 days remaining to be activated, or Office prompts users to activate now, or similar. This doesn’t necessarily indicate an issue with PVS image preparation, or with the streamed image. It’s up t...

Getting "Request not supported" while launching a published Desktop with FAS enabled

Launching of a published desktop fails when StoreFront server is configured to use FAS. You will get an error "Request Not Supported ". The below error may be seen in Kerberos event logs on the VDA when attempting to launch. 0x10 - KDCERRPADATATYPENOSUPP: KDC has no support for padata type Kerber...

Windows Remote Incident Response: CimSweep

Windows Remote Incident Response CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CimSweep may also be used to engage in offensive reconnaissance without the need to drop any payload to...

Python Windows Event Log Parser: python-evtx

Python Windows Event Log Parser python-evtx is a pure Python parser for recent Windows Event Log files those with the file extension “.evtx”. The module provides programmatic access to the File and Chunk headers, record templates, and event entries. For example, you can use python-evtx to review...

WMI vs. WMI: Monitoring for Malicious Activity

Hello my name is: WMI WMI has been a core component of Windows since Windows 98, but it is not exactly old wine in a new bottle. WMI more closely resembles that bottle of ‘61 Bordeaux wine that continues to impress us as it ages and matures. WMI was developed as Microsoft’s interpretation of...