CVE-2021-39900

Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs...

CVE-2021-39900

Removed by vendor...

GitLab 日志信息泄露漏洞

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. An information disclosure vulnerability exists in GitLab...

PT-2021-22747 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.8 and later Description: The issue allows for information disclosure from SendEntry in GitLab, exposing the full URL of artifacts stored in object-storage. This exposure occurs via Rails logs and is temporary...

Tips & Tricks for Unmasking Ghoulish API Behavior

I was analyzing one of my customer’s API traffic the other day and I noticed something odd about the devices that were using the mobile application API. I found standard browsers like Firefox and Chrome hitting API endpoints that should only be touched by their mobile-application communication. I...

New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught

Cybersecurity researchers have disclosed an unpatched security vulnerability in the protocol used by Microsoft Azure Active Directory that potential adversaries could abuse to stage undetected brute-force attacks. "This flaw allows threat actors to perform single-factor brute-force attacks agains...

OESA-2021-1359 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: Cockpit and its plugins do not seem to protect itself against...

Postbox Credential Gatherer

This module searches for Postbox credentials on a Windows host. Module Options msf use post/windows/gather/credentials/postbox msf postpostbox show actions ...actions... msf postpostbox set ACTION msf postpostbox show options ...show and set options... msf postpostbox run This module requires...

Incredimail Credential Gatherer

This module searches for Incredimail credentials on a Windows host. Module Options msf use post/windows/gather/credentials/incredimail msf postincredimail show actions ...actions... msf postincredimail set ACTION msf postincredimail show options ...show and set options... msf postincredimail run...

ICQ Credential Gatherer

This module searches for ICQ credentials on a Windows host. Module Options msf use post/windows/gather/credentials/icq msf posticq show actions ...actions... msf posticq set ACTION msf posticq show options ...show and set options... msf posticq run This module requires Metasploit:...

New BloodyStealer malware steals data from gamers on EA, Epic, Steam

By Waqas The BloodyStealer malware is sold on Russian hacking forums while its capabilities include stealing gaming logs, login credentials, and much more. This is a post from HackRead.com Read the original post: New BloodyStealer malware steals data from gamers on EA, Epic, Steam...

Unable to integrate Azure Active Directory as IDP directly on CEM

While performing AAD integration in CEM console, it shows error stating 'Your IDP settings could not be saved. The connection failed. Please review the information you entered.' We do not see any errors in the CEM logs for above issue...

CVE-2021-34408

The Zoom Client for Meetings for Windows in all versions before version 5.3.2 writes log files to a user writable directory as a privileged user during the installation or update of the client. This could allow for potential privilege escalation if a link was created between the user writable...

GHSA-74J8-88MM-7496 Confused Deputy in Kubernetes

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...

Confused Deputy in Kubernetes

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...

Externally Controlled Reference to a Resource in Another Sphere

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...

CVE-2020-8561

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...

UBUNTU-CVE-2020-8561

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the lo...

The vulnerability of the export report function implementation in Centreon software for IT infrastructure monitoring allows a hacker to execute arbitrary SQL commands.

The vulnerability of the software’s reporting export function for IT infrastructure monitoring in Centreon relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands using the script...

MetInfo SQL Injection Vulnerability (CNVD-2021-74293)

MetInfo using PHP + Mysql architecture, is a very SEO-friendly, full-featured, support for multi-language, responsive display, extremely suitable for business, corporate website construction cms station-building system. MetInfo 7.0.0 version of the existence of SQL injection vulnerability,...