USN-3772-1 udisks2 vulnerability

It was discovered that UDisks incorrectly handled format strings when logging. A local attacker could possibly use this issue to cause a denial of service or obtain sensitive information...

SharpSploit - A .NET Post-Exploitation Library Written In C#

SharpSploit is a .NET post-exploitation library written in C that aims to highlight the attack surface of .NET and make the use of offensive .NET easier for red teamers. SharpSploit is named, in part, as a homage to the PowerSploit project, a personal favorite of mine! While SharpSploit does port...

Security update for liblouis (moderate)

This update for liblouis fixes the following issues: Security issues fixed: - CVE-2018-11440: Fixed a stack-based buffer overflow in the function parseChars in compileTranslationTable.c bsc1095189 - CVE-2018-11577: Fixed a segmentation fault in loulogPrint in logging.c bsc1095945 - CVE-2018-11683...

DEBIAN-CVE-2018-17336

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

UBUNTU-CVE-2018-17336

UDisks 2.8.0 has a format string vulnerability in udiskslog in udiskslogging.c, allowing attackers to obtain sensitive information stack contents, cause a denial of service memory corruption, or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n...

September 20, 2018—KB4457141 (OS Build 15063.1358)

None None...

Information disclosure

Elastic Cloud Enterprise ECE versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to t...

CVE-2018-3827

A sensitive data disclosure flaw was found in the Elasticsearch repository-azure formerly elasticsearch-cloud-azure plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged...

CVE-2018-3828

Elastic Cloud Enterprise (ECE) prior to version 1.1.4 contains an information exposure vulnerability where certain exception conditions can leak encryption keys, passwords, and other sensitive headers to allocator logs. An attacker with access to the logging cluster could obtain leaked credential...

CVE-2018-3828

Elastic Cloud Enterprise ECE versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to t...

Mail Security Testing Framework

Mail Security Testing Framework is a testing framework for mail security and filtering solutions. The mail security testing framework works with with Python =3.5. Just pull this repository and go ahead. No further dependencies are required. Usage The script mail-tester.py runs the tests. Read the...

Storefront 3.15 | Storefront propagation fails.

Propagation fails on Server 2012R2 machine. In event logs: Log Name: Citrix Delivery Services Source: Citrix Configuration Replication An error occurred when starting the 'WAS' Windows service. System.ServiceProcess.TimeoutException, System.ServiceProcess, Version-4.0.0.0, Culture=neutral,...

Advanced Network Reconnaissance Toolkit: badKarma

badKarma is a python3 GTK+ toolkit that aim to assist penetration testers during all the network infrastructure penetration testing activity phases. It allow testers to save time by having point-and-click access to their toolkits, launch them against single or multiple targets and interacte with...

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

An XML deserialization vulnerability was discovered in slf4j's EventData, which accepts an XML serialized string and can lead to arbitrary code execution...

Moderate: Red Hat Enhancement Advisory: VDSM bug fix and enhancement update 4.2

Updated vdsm packages that fix several bugs and add various enhancements are now available. VDSM is a management module that serves as a Red Hat Virtualization Manager agent on Red Hat Virtualization Host or Red Hat Enterprise Linux hosts. Changes to the vdsm component: Previously, multipath...

DEBIAN-CVE-2018-16328

In ImageMagick before 7.0.8-8, a NULL pointer dereference exists in the CheckEventLogging function in MagickCore/log.c...

openSUSE Security Update : nextcloud (openSUSE-2018-936)

This update for nextcloud to version 13.0.5 fixes the following issues : Security issues fixed : - CVE-2018-3780: Fixed a missing sanitization of search results for an autocomplete field that could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names,...

Threat Analysis: Recent Attack Technique Leveraging cmd.exe and PowerShell Demonstrates How Attackers Are Using Trusted Microsoft Applications for Malicious Behavior

An attack leveraging cmd.exe and PowerShell was recently investigated by Cb ThreatSight analysts. Our initial investigation discovered that a batch file was executed on the targeted system. This batch file then invoked PowerShell with a base64 encoded command. Decoding the command revealed a seri...

Microsoft Windows: Audit Special Logon

Audit Special Logon determines whether the operating system generates audit events under special sign on or log on circumstances. This subcategory allows you to audit events generated by special logons such as the following: - The use of a special logon, which is a logon that has...

CVE-2018-15491

A vulnerability in the permission and encryption implementation of Zemana Anti-Logger 1.9.3.527 and prior fixed in 1.9.3.602 allows an attacker to take control of the whitelisting feature MyRules2.ini under %LOCALAPPDATA%\Zemana\ZALSDK to permit execution of unauthorized applications such as ones...