8902 matches found
CVE-2018-1000060
Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text...
What you didn’t know about OWASP Top-10 2017? Part 3/3
This is the last part of my trilogy about OWASP Top-10 2017 risks. Two previous parts one and two described A1-A6 risks and this time I’d like to not just explain A7-A10 risks but also draw an intersection or overlap venn diagram of them. I hope this diagram would clarify why the questions about...
CVE-2018-1000060
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...
CVE-2018-1000060
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redactsensitive that can result in sensitive configuration data e.g. passwords may be logged in clear-text. This attack appear to be exploitabl...
Hotspot Shield Vulnerability Could Reveal ‘Juicy’ Info About Users, Researcher Claims
UPDATE A vulnerability in the popular HotSpot Shield VPN client, which is promoted as being able to hide users’ identities, could expose their IP addresses and “other juicy info,” according to a security researcher. Paulos Yibelo, a researcher who has collected on a number of bug bounties in the...
CVE-2018-1192
The CVE-2018-1192 issue affects Cloud Foundry components: cf-release (< v285), cf-deployment (< v1.7), UAA (< 4.5.5 in 4.5.x; < 4.8.3 in 4.8.x; < 4.7.4 in 4.7.x), and UAA-release (< 45.7, < 52.7,
2017 OWASP Top 10: The Good, the Bad and the Ugly
Since its founding in 2001, the Open Web Application Security Project OWASP has become a leading resource for online security best practices. In particular, its list of the top 10 “Most Critical Web Application Security Risks” is a de facto application security standard. The recently released 201...
CVE-2018-5711
creationtimestamp| type| source ---|---|--- 2018-01-22 12:56:46+00:00| published-proof-of-concept| https://t.me/news4hack/31 2024-11-14 06:07:44+00:00| seen| MISP/a57f7f1a-11dd-462d-81cd-6cf385407046 2026-07-26 00:00:11+00:00| seen| Telegram/bNjb-vyQBQI1oInEWRCRvDmKkFJUwtCpxCihTDPD4pQKrg 2026-07-...
[SECURITY] Fedora 27 Update: rootsh-1.5.3-17.fc27
Rootsh is a wrapper for shells which logs all echoed keystrokes and terminal output to a file and/or to syslog. Its main purpose is the auditing of users who need a shell with root privileges. They start rootsh through the sudo mechanism...
openSUSE Security Update : syncthing (openSUSE-2018-45)
This update for syncthing brings a new version and fixes the following issues : - Update to version 0.14.42 : - Discovering new files in a deleted directory does not resurrect the directory ghsyncthing/syncthing4475. - 'Panic: interface conversion: errors.errorString is not net.Error' after resta...
CVE-2017-18014
An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page Control Center - Log Viewer - in the filter option "Web Server Protection" in the webadmin...
Linksys WVBR0 25 Command Injection(CVE-2017-17411)
In this guest blog, Trend Micro DVLabs researcher Ricky Lawshae discusses the recently disclosed CVE-2017-17411. He discovered and reported this bug through the ZDI program. Earlier this year, I learned that AT&T was starting to move customers away from its U-Verse service in favor of its DirecTV...
RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2 (RHSA-2017:3399)
The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2017:3399 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This asynchrono...
Description of the security update for SharePoint Server 2016: December 12, 2017
None None...
Elasticsearch Packetbeat PostgreSQL protocol handler denial of service vulnerability
Elasticsearch Packetbeat is a set of lightweight network packet analysis tools from the Dutch company Elasticsearch.PostgreSQL protocol handler is one of the PostgreSQL protocol handlers. A denial of service vulnerability exists in the PostgreSQL protocol handler in Elasticsearch Packetbeat...
log4j: Socket receiver deserialization vulnerability
It was found that when using remote logging with log4j socket server the log4j server would deserialize any log event received via TCP or UDP. An attacker could use this flaw to send a specially crafted log event that, during deserialization, would execute arbitrary code in the context of the...
Stack overflow
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging...
CVE-2017-16930
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging...
Tor: De-anonymization by visiting specially crafted bookmark.
There is a way to import logs in 'about:memory' from local disk, however, tested on windows you can pass a network url that may point to attack controlled server which logs IP's. This connection is done by windows presumably and so doesn't hide real IP of Tor user. 1. Have victim drag and drop an...
