Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasticsearch audit log could contain sensitive information such as password hashes or authentication tokens. This could allow an Elasticsearch administrator to view these details.

...

Malicious Google Play Apps Stole User Banking Info

Using tricks to sidestep the app store's restrictions, malware operators pillaged passwords, keystrokes, and other data...

Information disclosure

Sensitive information could be logged. The following products are affected: Acronis Agent Windows, Linux, macOS before build 27147...

CVE-2021-34800

CVE-2021-34800 affects Acronis Agent (Windows, Linux, macOS) prior to build 27147. The vulnerability is an information disclosure where sensitive product details are logged in log files. Connected sources confirm affected builds and describe the issue as a log information disclosure; no exploitat...

OPENSUSE-SU-2021:1513-1 Security update for tor

This update for tor fixes the following issues: tor 0.4.6.8: Improving reporting of general overload state for DNS timeout errors by relays Regenerate fallback directories for October 2021 Bug fixes for onion services CVE-2021-22929: do not log v2 onion services access attempt warnings on disk...

PT-2021-20658

Name of the Vulnerable Software and Affected Versions: Acronis Agent versions prior to build 27147 Description: Sensitive information could be logged. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where...

WP Mail Logging < 1.10.0 - Outdated Redux Framework

The plugin uses an outdated version of the Redux Framework, which is know to be affected by security issues CVE-2021-38312 and CVE-2021-38314, and could allow unauthenticated attackers to change some of the Framework settings by using CVE-2021-38314 PoC The first endpoint we can identify is...

WordPress WP Mail Logging plugin <= 1.9.9 - Using Components with Known Vulnerabilities (vulnerable Redux Framework version)

Using Components with Known Vulnerabilities vulnerable Redux Framework version - CVE-2021-38312, CVE-2021-38314 discovered by Rotem Reiss in WordPress WP Mail Logging plugin versions = 1.9.9. Solution Update the WordPress WP Mail Logging plugin to the latest available version at least 1.10.0...

DetectionLabELK - A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is a fork from Chris Long's DetectionLab with ELK stack instead of Splunk. Description: DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to...

CVE-2021-34800

Sensitive information could be logged. The following products are affected: Acronis Agent Windows, Linux, macOS before build 27147...

HikPwn

This is an offensive tool for Hikvision devices. The tool, named HikPwn, is a simple scanner written in Python 3.8 that performs basic vulnerability scanning capabilities. It was created by Ananke and is available on GitHub. The tool has several functions and characteristics, including passive an...

OPENSUSE-SU-2021:1494-1 Security update for hylafax+

hylafax+ was updated to version 7.0.4: README.SUSE renamed hylafax.diff added for boo1191571 pre-correction Dependencies on systemd-services adjusted retry training twice at the same bitrate unless FTT 26 Aug 2021 add missing reason messages for session failures 21 Aug 2021 stop attempts to send ...

Cisco Common Services Platform Collector improper logging restrictions vulnerability

Cisco Common Services Platform Collector CSPC is an SNMP-based tool that discovers and collects information from Cisco devices installed on the network. versions of Cisco Common Services Platform Collector prior to 2.9.1.1 of the Web application contains an improper logging restriction...

CVE-2021-40130 Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

A vulnerability in the web application of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit...

CVE-2021-40130 Cisco Common Services Platform Collector Improper Logging Restriction Vulnerability

A vulnerability in the web application of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to specify non-log files as sources for syslog reporting. This vulnerability is due to improper restriction of the syslog configuration. An attacker could exploit...

CVE-2021-27026

A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged...

CVE-2021-27026

A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged...

What is a firewall ❓ Everything you need to know about

In the tech world, a firewall is a wellbeing network framework that screens and controls moving ever closer affiliation traffic dependent upon destined security rules. A firewall ordinarily draws up a line between a confided in affiliation and an untrusted affiliation, like the Internet.‍ What is...

PT-2021-17235

Name of the Vulnerable Software and Affected Versions: Puppet Enterprise and other Puppet products affected versions not specified Description: A flaw was discovered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged. Recommendations: At the moment, there...

Medium: docker

Issue Overview: Docker Engine before 18.09 allows attackers to cause a denial of service dockerd memory consumption via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemonunix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go. CVE-2018-20699 A command injectio...