Graylog Trust Management Issue Vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. A security vulnerability exists in Graylog versions prior to 3.3.3, which stems from the program failing to adequately validate the SSL...

CVE-2020-15813

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

CVE-2020-15813

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

Design/Logic Flaw

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

CVE-2020-15813

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

CVE-2020-15813

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

CVE-2020-15813

CVE-2020-15813 affects Graylog before 3.3.3, where LDAP connections do not validate SSL certificates. This enables an attacker with network access between Graylog and an LDAP server to redirect traffic to a malicious LDAP server, bypassing Graylog authentication. Affected component: Graylog’s LDA...

PT-2020-14644

Name of the Vulnerable Software and Affected Versions Graylog versions prior to 3.3.3 Description The issue concerns a lack of SSL Certificate Validation for LDAP servers, allowing an attacker to intercept network traffic between a Graylog server and an LDAP server. This enables the attacker to...

CVE-2020-15813: Improper Certificate Validation

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code in all versions that suppo...

Cross-Site Scripting

Overview All versions of graylog-web-interface are vulnerable to Cross-Site Scripting XSS. The package fails to escape output on the TypeAhead and QueryInput components, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation No fix is currently available...

Imperva Cloud WAF and Graylog, Part II: How to Collect and Ingest SIEM Logs

This guide gives step-by-step guidance on how to collect and parse Imperva Cloud Web Application Firewall WAF, formerly Incapsula logs into the Graylog SIEM tool. Read Part I to learn how to set up a Graylog server in AWS and integrate with Imperva Cloud WAF. This guide assumes: You have a clean...

How to Deploy a Graylog SIEM Server in AWS and Integrate with Imperva Cloud WAF

Security Information and Event Management SIEM products provide real-time analysis of security alerts generated by security solutions such as Imperva Cloud Web Application Firewall WAF. Many organizations implement a SIEM solution to bring visibility of all security events from various solutions...

Cross-site Scripting (XSS)

graylog-web-interface is vulnerable to a cross-site scripting XSS attack. The library does not properly escape the text in the Dashboard, allowing a malicious user to inject and execute arbitrary Javascript...

Design/Logic Flaw

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

CVE-2018-14380

CVE-2018-14380 affects Graylog before 2.4.6, where XSS was possible in typeahead components (TypeAheadInput.jsx and QueryInput.ts). The vulnerability is tied to the typeahead UI paths and could allow inline script execution. A fix is available in Graylog 2.4.6; upgrading to this version is the re...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (1.0.0), com.airbus-cyber-security.graylog:graylog-plugin-logging-alert (>=1.0.0, <=1.0.1) +8 more potentially affected by CVE-2018-14380 via org.graylog2:graylog2-server (>=1.0.0-beta.3, <=2.4.5)

org.graylog2:graylog2-server MAVEN version =1.0.0-beta.3, =1.0.0, =1.0.2, =2.2.0-alpha.1, =1.1.0, =2.2.0-beta.1, =2.2.0-alpha.1, =1.0.3, =1.0.0-beta.2, =1.2.0-rc.1, =1.3.4 Source cves: CVE-2018-14380 Source advisory: MEND:CVE-2018-14380...