9494 matches found
Denial Of Service (DoS)
Pyftpd is vulnerable to denial of service and information disclosure. The vulnerability existed because logs files with predictable names in a temporary directory are created, which allows local users to cause a denial of service and obtain sensitive information...
Aclpwn.Py - Active Directory ACL Exploitation With BloodHound
Aclpwn.py is a tool that interacts with BloodHound to identify and exploit ACL based privilege escalation paths. It takes a starting and ending point and will use Neo4j pathfinding algorithms to find the most efficient ACL based privilege escalation path. Aclpwn.py is similar to the PowerShell...
SAP Adaptive Server Enterprise Information Disclosure Vulnerability (CNVD-2020-74929)
SAP Adaptive Server Enterprise ASE is a relational database server from SAP, Germany. An information disclosure vulnerability exists in SAP Adaptive Server Enterprise. The vulnerability allows an attacker with local access rights to access sensitive information that appears in installation log...
CVE-2020-6317
In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears in the installation log files. This information although sensitive is of limited utility and cannot be used to further access, modify or...
Fortinet FortiOS System File Leak
The Cybersecurity and Infrastructure Security Agency CISA is aware of the possible exposure of passwords on Fortinet devices that are vulnerable to CVE 2018-13379. Exploitation of this vulnerability may allow an unauthenticated attacker to access FortiOS system files. Potentially affected devices...
Authentication flaw
Barco wePresent WiPG-1600W devices allow Authentication Bypass. Affected Versions: 2.5.1.8. The Barco wePresent WiPG-1600W web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET...
3 Ways to Hunt for the ZeroLogon Vulnerability on Your Windows Servers
Vulnerability assessment and patch management can be painful time-consuming processes. From the Security team looking at vulnerability reports and prioritizing the riskiest ones for their environment to the IT or Infrastructure team determining exactly which machines need to be patched and...
CVE-2020-25678
A flaw was found in Ceph where Ceph stores mgr module passwords in clear text. This issue can be found by searching the mgr logs for Grafana and dashboard, with passwords visible. The highest threat from this vulnerability is to confidentiality...
CVE-2020-13942
creationtimestamp| type| source ---|---|--- 2020-11-23 03:53:17+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/2119 2020-11-23 09:45:55+00:00| published-proof-of-concept| https://t.me/cKure/2943 2020-11-24 20:46:57+00:00| seen| https://t.me/cibsecurity/16796 2023-11-22...
SIRAS - Security Incident Response Automated Simulations
Security Incident Response Automated Simulations SIRAS are internal/controlled actions that provide a structured opportunity to practice the incident response plan and procedures during a realistic scenarios. the main idea of SIRAS is create an detection-as-a-code testing scenarios to facilitate...
Barco wePresent WiPG-1600W Authentication Bypass Vulnerability
The Barco wePresent WiPG-1600W version 2.5.1.8 web interface does not use session cookies for tracking authenticated sessions. Instead, the web interface uses a "SEID" token that is appended to the end of URLs in GET requests. Thus the "SEID" would be exposed in web proxy logs and browser history...
GaussDB Kernel: Configuring the Server Log Message Level
The parameter logminmessages specifies the level of messages to be written into server logs. The valid values include DEBUG5, DEBUG4, DEBUG3, DEBUG2, DEBUG1, INFO, NOTICE, WARNING, ERROR, LOG, FATAL, and PANIC. It must be NOTICE at least. After a level is selected, messages at this level and its...
GaussDB Kernel: Configure an Audit Priority Policy
Configures the policy for determining whether audit logs are preferentially stored by space or time. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
GaussDB Kernel: Configuring the Levels of Logs to Be Written into the Server
The parameter logerrorverbosity specifies the level of logs to be written into the server. The value can be TERSE, DEFAULT, or VERBOSE. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
GaussDB Kernel: Configuring Rsyslog for Unified Audit Logs
By default, unified audit logs are output to the Rsyslog on each CN. User root is authorized to configure and view the logs. Ensure that enablesecuritypolicy is Enabled. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright...
GaussDB Kernel: Enabling the Database Auditing
After a security event occurs, audit logs are used to trace the event, locate faults, and clarify responsibilities. You are advised to set auditenabled to on. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...
GaussDB Kernel: Configuring the Maximum Number of Audit Log Files
The parameter auditfileremainthreshold specifies the maximum number of audit log files. When the total number of audit log files exceeds the specified value, the system writes the warning information to the database logs, deletes the earliest audit log files, and records the deletion to the audit...
Authorization
JamoDat TSMManager Collector version up to 6.5.0.21 is vulnerable to an Authorization Bypass because the Collector component is not properly validating an authenticated session with the Viewer. If the Viewer has been modified binary patched and the Bypass Login functionality is being used, an...
JetBrains TeamCity Unauthorized Access Vulnerability
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. An unauthorized vulnerability exists in JetBrains...