Zabbix Frontend Cross-Site Scripting Vulnerability (CNVD-2022-22695)

A cross-site scripting vulnerability in Zabbix Frontend, a monitoring software front-end tool from Zabbix USA, stems from a lack of data validation filtering of user-supplied data and output in the service configuration window, which could be exploited by an authenticated attacker to create a lin...

Zabbix Frontend Cross-Site Scripting Vulnerability

Zabbix Frontend is a monitoring software front-end tool from Zabbix, U.S. A cross-site scripting vulnerability exists in Zabbix Frontend, which could be exploited by an authenticated attacker to create a link to a graphical page with reflected Javascript code and send it to other victims...

CVE-2022-24399

The SAP Focused Run Real User Monitoring - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting XSS vulnerability...

CVE-2022-24399

The SAP Focused Run Real User Monitoring - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting XSS vulnerability...

Cross site scripting

The SAP Focused Run Real User Monitoring - versions 200, 300, REST service does not sufficiently sanitize the input name of the file using multipart/form-data, resulting in Cross-Site Scripting XSS vulnerability...

Aternity SteelCentral AppInternals 路径遍历漏洞

Aternity SteelCentral AppInternals is a monitoring modern automation solution from Aternity, Inc. A directory traversal vulnerability exists in Aternity SteelCentral AppInternals, which stems from the fact that /api/appInternals/1.0/plugin/pmx does not perform any validation of user input that...

Ericsson Network Manage安全漏洞

Ericsson Network Manage is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. A security vulnerability exists in Ericsson Network Manager 20.2 that stems from a privilege error...

SAP Focused Run 跨站脚本漏洞

SAP Focused Run is a data center and large customer system operations management solution the ultimate solution for high-volume monitoring, alerting, diagnostics, and analytics from SAP, Germany. A cross-site scripting vulnerability exists in SAP Focused Run. No information about this vulnerabili...

Design/Logic Flaw

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolv...

CVE-2022-24714

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

CVE-2022-24714 Disclosure of hosts and related data, linked to decommissioned services in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affected. If you use service custom variables in role restrictions, and you regularly decommission service objects, users with said roles may...

CVE-2022-24716

CVE-2022-24716 affects Icinga Web 2: Unauthenticated arbitrary file disclosure via directory traversal in the web interface, exposed through the icinga-php-thirdparty/library paths. Root cause: directory traversal allowing access to local files (e.g., icingaweb2 config with DB credentials). Impac...

PT-2022-16674 · Sap · Sap Focused Run

Name of the Vulnerable Software and Affected Versions: SAP Focused Run Real User Monitoring versions 200, 300 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. It occurs because the REST service does not sufficiently sanitize the input name of the file using...

CVE-2022-24716 Path traversal in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. This issue has been resolv...

CVE-2022-24715 Arbitrary code execution for authenticated users in Icinga Web 2

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

CVE-2022-24715

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. This issue has been resolved in versions 2.8.6...

Current executive guidance for ongoing cyberattacks in Ukraine

Read this blog post in 日本語 Japanese Cyber threat activity against Ukraine, and around the world, has long been a central focus of our work. We continue to monitor the Ukraine-Russia situation by enacting a comprehensive, Talos-wide effort to provide support to our partners and customers. These...

Grafana Cross-Site Request Forgery Vulnerability

Grafana is an open source monitoring tool from Grafana Labs that provides a visual monitoring interface. The tool is primarily used to monitor and analyze Graphite, InfluxDB, Prometheus, etc. A cross-site request forgery vulnerability exists in Grafana, which stems from the product's failure to...

Grafana Cross-Site Scripting Vulnerability (CNVD-2022-28802)

Grafana is a set of open source monitoring tools from Grafana Labs that provides a visual monitoring interface. The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus, etc. A cross-site scripting vulnerability exists in Grafana, which stems from the product's failure to...

Conti Ransomware Group Diaries, Part III: Weaponry

Part I of this series examined newly-leaked internal chats from the Conti ransomware group, and how the crime gang dealt with its own internal breaches. Part II explored what its like to be an employee of Contis sprawling organization. Todays Part III looks at how Conti abused popular commercial...