Artica Pandora FMS Information Disclosure Vulnerability (CNVD-2020-20720)

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS 7.42 and earlier versions. An attacker can exploit the vulnerability...

Storefront | Unable To Join Secondary Storefront Server To Server Group.

ERROR: Unable to join server in existing server group. Add server failed - Add of server XYZ to server group failed. In event logs we could see 'access is denied' exception while running the command : 'Add-DSCertificateToDSStore'...

Information Disclosure

easybuildframework is vulnerable to information disclosure. The vulnerability exists as sensitive information such as the GitHub Personal Access Token are improperly handled and shown in plain text in EasyBuild's debug logs...

GHSA-2WX6-WC87-RMJM GitHub personal access token leaking into temporary EasyBuild (debug) logs

Impact The GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --from-pr, etc. is shown in plain text in EasyBuild debug log files. Scope: the log message only appears in the top-level log file, not in the individual software installation logs see...

PYSEC-2020-268

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

PYSEC-2020-41

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

CVE-2020-5262 GitHub personal access token leaking into temporary EasyBuild (debug) logs

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

DEBIAN-CVE-2020-1753

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl...

CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...

CVE-2019-16157

An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via diagnose debug commands...

Linux: daemon.debug in /etc/rsyslog.conf

Test if and to which file the debug logs generated by the daemon process are recorded. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Storefront 3.12 CU5 Error: Propagation failed on one or more Servers

PROBLEM: When administrator launches Storefront Management Console and attempts to perform "Propagate Changes" on Servers , the process fails with the following error: Error: Propagation failed on one or more Servers Event logs on Primary Server shows the following event: Event ID 31 An error has...

PT-2020-2443 · Siemens · Control Center Server +1

Name of the Vulnerable Software and Affected Versions: Control Center Server CCS versions prior to V1.5.0 SiNVR/SiVMS Video Server versions prior to V5.0.0 Description: A vulnerability has been identified where the FTP services of the SiVMS/SiNVR Video Server and the Control Center Server CCS...

Extended-XSS-Search - Scans For Different Types Of XSS On A List Of URLs

This is the extended version based on the initial idea already published as "xssfinder". This private version allows an attacker to perform not only GET but also POST requests. Additionally its possible to proxy every request through Burp or another tunnel. First steps Rename the...

CVE-2020-4083

HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user...

Information disclosure

HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user...

CVE-2020-4083

HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user...

CVE-2020-4083

CVE-2020-4083 affects HCL Connections 6.5, where information could be disclosed via trace logs to a local user. The connected documents provide the vulnerability description and CVSS metrics (CVSSv3.1 base score 5.5, MEDIUM; LOCAL access; high confidentiality impact) but do not include remediatio...

OpenSMTPD Out-Of-Bounds Read / Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenSMTPD OOB Read Local Privilege Escalation', 'Description' = %q This module exploits an out-of-bounds read of an attacker-controlled string in...

Deploy a Cloud WAF & DDoS Solution While Complying with Australian Data Sovereignty

Australia has strict data sovereignty laws in place to ensure that personal customer data remains within the country’s borders. However, we often hear about cloud-based WAF vendors being unable to guarantee that data will not be moved across borders for inspection and data logging purposes. This...