Bnistack error 85 - IOS Socket UNAVAILABLE - not counting retry

Target Devices actively connected to Provisioning Services suddenly exhibit severe performance issues such as: Target completely hangs Performance is extremely slow Number of retries increases dramatically Atthe same time the following error is found in the Event Logs inside the Target Device:...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure Vunerability

Farmer's Fridge Kiosk version 2.0.0 suffers from an unprotected event log information disclosure vulnerability as well as unauthenticated request issues. Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com...

Farmer's Fridge Kiosk 2.0.0 Information Disclosure

Farmer's Fridge Kiosk 2.0.0 Unprotected Event Log Information Disclosure Vendor: Farmer's Fridge Product web page: http://www.farmersfridge.com Affected version: 2.0.0 Summary: Donat think of the Farmeras Fridge kiosk as a vending machine. Itas a veggie machine. And just as each salad is a culina...

Unifiltr EventID 3: Unidesk denied an attempt to rename a directory

Your software may report an error attempting to rename a directory, you may receive an error trying to move a folder to the Recycle Bin, and you may see an error in the Windows System event log on an IM that looks like this: Log Name: System Source: unifltr Date: 10/23/2013 9:58:30 PM Event ID: 3...

StoreFront SAML Troubleshooting Guide

During the installation and configuration of the SAML functionality introduced with StoreFront 3.9, there are various items to be aware of when performing a successful configuration. Although there are other issues you might encounter, this document will try to provide direction to help resolve...

Overview of Windows activation with KMS server

Sometimes after properly following the preparation steps, on start up the Operating System shows only 3 days remaining to be activated, or Office prompts users to activate now, or similar. This doesn’t necessarily indicate an issue with PVS image preparation, or with the streamed image. It’s up t...

Getting "Request not supported" while launching a published Desktop with FAS enabled

Launching of a published desktop fails when StoreFront server is configured to use FAS. You will get an error "Request Not Supported ". The below error may be seen in Kerberos event logs on the VDA when attempting to launch. 0x10 - KDCERRPADATATYPENOSUPP: KDC has no support for padata type Kerber...

Windows Remote Incident Response: CimSweep

Windows Remote Incident Response CimSweep is a suite of CIM/WMI-based tools that enable the ability to perform incident response and hunting operations remotely across all versions of Windows. CimSweep may also be used to engage in offensive reconnaissance without the need to drop any payload to...

Python Windows Event Log Parser: python-evtx

Python Windows Event Log Parser python-evtx is a pure Python parser for recent Windows Event Log files those with the file extension “.evtx”. The module provides programmatic access to the File and Chunk headers, record templates, and event entries. For example, you can use python-evtx to review...

WMI vs. WMI: Monitoring for Malicious Activity

Hello my name is: WMI WMI has been a core component of Windows since Windows 98, but it is not exactly old wine in a new bottle. WMI more closely resembles that bottle of ‘61 Bordeaux wine that continues to impress us as it ages and matures. WMI was developed as Microsoft’s interpretation of...

Windows Process Filtering System: ProcFilter

Windows Process Filtering System ProcFilter is a process filtering system for Windows with built-in YARA integration. YARA rules can be instrumented with custom meta tags that tailor its response to rule matches. It runs as a Windows service and is integrated with Microsoft’s ETW API , making...

Windows Desktop Experience Data Compromise

A vulnerability that allows for remote execution of code exists in the Windows event log system and is related to the processing of specially crafted files. Exploiting this vulnerability enables remote execution of code, provided that the user opens a specially crafted event log file. If the user...

Windows Data Compromise

A vulnerability that allows for remote execution of code exists in the Windows event log system and is related to the processing of specially crafted files. Exploiting this vulnerability enables remote execution of code provided that the user opens a specially crafted event log file. If the user...

Windows Code Execution

The vulnerability of the Windows operating system’s event log exists due to insufficient checking of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely using a specially crafted JNT file...

Windows Code Execution

The vulnerability of the Windows operating system is related to a numerical overflow during the processing of event log files. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code using a specially crafted JNT file...

ManageEngine EventLog Analyzer 10.6 Build 10060 SQL Query Execution

Exploit Title: ManageEngine EventLog Analyzer SQL query execution Product: ManageEngine EventLog Analyzer Vulnerable Versions: v10.6 build 10060 and previous versions Tested Version: v10.6 build 10060 Windows Advisory Publication: 14/09/2015 Vulnerability Type: authenticated SQL query execution...

Microsoft Windows - CreateObjectTask SettingsSyncDiagnostics Privilege Escalation

Microsoft Windows - CreateObjectTask SettingsSyncDiagnostics Privilege Escalation Source: https://code.google.com/p/google-security-research/issues/detail?id=437 Windows: CreateObjectTask SettingsSyncDiagnostics Elevation of Privilege Platform: Windows 8.1 Update I don’t believe it’s available in...

Microsoft Windows - CreateObjectTask SettingsSyncDiagnostics Privilege Escalation

Source: https://code.google.com/p/google-security-research/issues/detail?id=437 Windows: CreateObjectTask SettingsSyncDiagnostics Elevation of Privilege Platform: Windows 8.1 Update I don’t believe it’s available in earlier Windows versions Class: Elevation of Privilege Summary: The...

PT-2015-2005

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to insufficient input validation in the Windows operating system's event log. It can be exploited by a remote attacker using a specially crafted JNT file, potentially...

Windows Code Execution

The vulnerability of the Windows operating system exists due to incorrect handling of the event log file. The vulnerability can be exploited by opening the event log file created by the attacker. As a result of exploiting this vulnerability, an attacker who operates remotely can execute arbitrary...