Logs AWS credentials when TRACE-level logging is enabled

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

RUSTSEC-2023-0125 Logs AWS credentials when TRACE-level logging is enabled

aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is...

CVE-2023-0317

CVE-2023-0317 affects Secomea GateManager. The vulnerability is described as an Unprotected Alternate Channel in the debug console that allows a system administrator to obtain sensitive information. The NVD entry lists a CVSS v3.1 base score of 4.9 (Medium) with Confidentiality Impact High and no...

CVE-2023-0317 GateManager debug interface is included in non-debug builds

Unprotected Alternate Channel vulnerability in debug console of GateManager allows system administrator to obtain sensitive information...

GateManager 安全漏洞

Secomea GateManager is a remote access server product from Secomea, Denmark. A security vulnerability exists in Secomea GateManager that stems from an unprotected alternate channel vulnerability in the debug console, which could allow a system administrator to access sensitive information...

PT-2023-16172 · Unknown · Gatemanager

Name of the Vulnerable Software and Affected Versions: GateManager affected versions not specified Description: The issue concerns an Unprotected Alternate Channel vulnerability in the debug console of GateManager. This vulnerability allows a system administrator to obtain sensitive information...

CVE-2023-29002

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

Design/Logic Flaw

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

CVE-2023-29002 Debug mode leaks confidential data in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

CVE-2023-29002

Cilium (eBPF-based dataplane) in debug mode logs contents of the cilium-secrets namespace, potentially exposing TLS private keys for Ingress/GatewayAPI. This could enable an attacker with access to debug output to intercept/modify traffic to the cluster. The issue occurs at agent restart, on secr...

CVE-2023-29002 Debug mode leaks confidential data in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

CVE-2023-29002 Debug mode leaks confidential data in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

...

Cilium 日志信息泄露漏洞

Cilium is an open source software. It is used to provide and transparently secure network connectivity and load balancing between application workloads such as application containers or processes. A logging information disclosure vulnerability exists in Cilium that stems from Cilium logging...

PT-2023-22078 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.11.16 Cilium versions prior to 1.12.9 Cilium versions prior to 1.13.2 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log t...

Terminalfour Information Disclosure Vulnerability

Terminalfour is a digital marketing and web content management platform for higher education from Terminalfour, Inc. Terminalfour suffers from an information disclosure vulnerability that stems from insufficient protection of sensitive information when debug logging is enabled. An attacker could...

Privilege Escalation

github.com/etcd-io/etcd is vulnerable to Privilege Escalation. The vulnerability exists due to improper authentication in v3server.go which allows an attacker to gain escalated privilege when the log level is set to debug...

RUSTSEC-2023-0035 Adverserial use of `make_bitflags!` macro can cause undefined behavior

The macro relied on an expression of the form Enum::Variant always being a variant of the enum. However, it may also be an associated integer constant, in which case there's no guarantee that the value of said constant consists only of bits valid for this bitflag type. Thus, code like this could...

Adverserial use of `make_bitflags!` macro can cause undefined behavior

The macro relied on an expression of the form Enum::Variant always being a variant of the enum. However, it may also be an associated integer constant, in which case there's no guarantee that the value of said constant consists only of bits valid for this bitflag type. Thus, code like this could...

CVE-2023-29193

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...