CVE-2018-8028

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table...

Schneider Electric Pelco Digital Sentry Video Management System Vulnerability

OVERVIEW Schneider Electric has identified a hard-coded credential vulnerability in Schneider Electric’s Pelco Digital Sentry Video Management System. Schneider Electric has produced a new firmware version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED...

CVE-2018-8028: Missing Authorization

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table...

PT-2018-18393

Name of the Vulnerable Software and Affected Versions: Apache Sentry versions prior to 2.0.1 Description: The issue allows an authenticated user to execute ALTER TABLE EXCHANGE PARTITIONS without proper authorization. This can lead to unauthorized access to partitioned data in a Sentry protected...

HackerOne: Blind SSRF on errors.hackerone.net due to Sentry misconfiguration

Summary: When setting up Sentry you should turn off "source code scrapping". If it is turned on, then server that has Sentry on it will make blind get requests everywhere controlled from outside via error reporting. Description: Hello Hackerone team. In your CSP I found ?sentrykey parameter, so i...

Mail.ru: Attacker can send requests from mail.ru server

SSRF was potentially possible via request to Sentry in-app error tracking / debugging system. Problem was mitigated by isolating Sentry installation to restricted network...

TNLSoftSolutions Sentry Information Disclosure Vulnerability

TNLSoftSolutions Sentry is a webcam device from TNLSoftSolutions, USA. A security vulnerability exists in the login page of TNLSoftSolutions Sentry version 3.x. The vulnerability can be exploited to obtain a password by reading the "ifpwd ==" line in the HTML source code...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

Design/Logic Flaw

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

CVE-2018-9031

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

CVE-2018-9031

Affected product: TNLSoftSolutions Sentry Vision 3.x devices. Vulnerability: Password disclosure through the login page by reading the HTML source line containing the pattern if(pwd ==. This effectively makes authentication rely on client-side logic, exposing passwords. Impact (as stated): Passwo...

PT-2018-18794

Name of the Vulnerable Software and Affected Versions TNLSoftSolutions Sentry Vision versions 3.x Description The issue concerns the login interface, which discloses passwords by allowing access to an "ifpwd ==" line in the HTML source code. This effectively means that authentication occurs only ...

CVE-2018-9031: Insufficiently Protected Credentials

The login interface on TNLSoftSolutions Sentry Vision 3.x devices provides password disclosure by reading an "ifpwd ==" line in the HTML source code. This means, in effect, that authentication occurs only on the client side...

Cross-site Scripting (XSS)

sentry-provider-db is vulnerable to cross-site scripting XSS attacks. The vulnerability exists as HTTP TRACE requests are possible, which can lead to XSS attacks...

FLARE IDA Pro Script Series: Simplifying Graphs in IDA

Introduction We’re proud to release a new plug-in for IDA Pro users – SimplifyGraph – to help automate creation of groups of nodes in the IDA’s disassembly graph view. Code and binaries are available from the FireEye GitHub repo. Prior to this release we submitted it in the 2017 Hex-Rays plugin...

K7 Antivirus K7Sentry.sys Denial of Service Vulnerability

K7 Antivirus is a suite of anti-virus software from the Indian company K7 Computing.K7Sentry.sys is one of the kernel-mode drivers used in K7 Computing's security products. A security vulnerability exists in the K7Sentry.sys 15.1.0.59 file in K7 Antivirus version 15.1.0309. It allows remote...

sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number...

GHSA-C9C5-9FPR-M882 sentry-raven allows remote attackers to cause a denial of service via a large exponent value in a scientific number

The numtok function in lib/raven/okjson.rb in the raven-ruby gem before 0.12.2 for Ruby allows remote attackers to cause a denial of service via a large exponent value in a scientific number...