CVE-2018-14380

CVE-2018-14380 affects Graylog before 2.4.6, where XSS was possible in typeahead components (TypeAheadInput.jsx and QueryInput.ts). The vulnerability is tied to the typeahead UI paths and could allow inline script execution. A fix is available in Graylog 2.4.6; upgrading to this version is the re...

CVE-2018-14380

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts...

THRecon - Threat Hunting Reconnaissance Toolkit

Collect endpoint information for use in incident response triage / threat hunting / live forensics using this toolkit. When a security alert raises concern over a managed system, this toolkit aims to empower the analyst with as much relevant information as possible to help determine if a compromi...

Graylog cross-site scripting vulnerability (CNVD-2018-11028)

Graylog is an open source log storage system , it supports the system log syslog saved to MongoDB distributed document storage database. A cross-site scripting vulnerability exists in the dashboard name in versions of Graylog prior to 2.4.4. A remote attacker can exploit this vulnerability to...

Graylog Cross-Site Scripting Vulnerability

Graylog is an open source log storage system , it supports the system log syslog saved to MongoDB distributed document storage database. A cross-site scripting vulnerability exists in notifications in Graylog versions prior to 2.4.4. A remote attacker can exploit this vulnerability to inject...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

Cross site scripting

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11650

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js...

CVE-2018-11651

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx...

CVE-2018-11651

Graylog before v2.4.4 is affected by an XSS vulnerability due to unescaped text in dashboard names, specifically in dashboard-related UI components (Dashboard.jsx, EditDashboardModal.jsx) and ShowDashboardPage.jsx. The issue enables script execution when dashboard names contain malicious content....

CVE-2018-11650

CVE-2018-11650 affects Graylog before 2.4.4, where unescaped text in notifications (util/UserNotification.js, toastr) enables a cross-site scripting (XSS) vulnerability. The issue arises in the notification output path and can allow injection of HTML/JS in user-facing notifications. Multiple conn...

Nzyme - Collects 802.11 Management Frames And Sends Them To A Graylog Setup For Wifi Ids, Monitoring, And Incident Response

Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog Open Source log management setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode. Think about this like a long-term months or years...

Wireless Monitoring, Intrusion Detection & Forensics: Nzyme

Nzyme collects 802.11 management frames directly from the air and sends them to a Graylog Open Source log management setup for WiFi IDS, monitoring, and incident response. It only needs a JVM and a WiFi adapter that supports monitor mode. Think about this like a long-term months or years...

Graylog Collector 0.4.2 - Unquoted Service Path Privilege Escalation

Exploit Title: Graylog Collector Service Path Privilege Escalation Date: 10/14/2016 Exploit Author: Joey Lane Software Link: https://github.com/Graylog2/collector Version: 0.4.2 Tested on: Windows Server 2012 R2 Graylog Collector installs as a service with an unquoted service path. If the user...

Graylog Collector 0.4.2 - Unquoted Service Path Privilege Escalation

Graylog Collector 0.4.2 - Unquoted Service Path Privilege Escalation Exploit Title: Graylog Collector Service Path Privilege Escalation Date: 10/14/2016 Exploit Author: Joey Lane Software Link: https://github.com/Graylog2/collector Version: 0.4.2 Tested on: Windows Server 2012 R2 Graylog Collecto...

Graylog Detection (HTTP)

HTTP based detection of Graylog. Copyright C 2016 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/...