EUVD-2014-2427

Malware in sbrugna...

EUVD-2023-35522

Malicious code in bioql PyPI...

EUVD-2025-7667

Malicious code in bioql PyPI...

EUVD-2022-4107

Malicious code in bioql PyPI...

CVE-2025-40591

CVE-2025-40591 affects Siemens RUGGEDCOM ROX II family devices (MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, RX5000) with

CVE-2024-48939

Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 SR4 enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data...

CVE-2013-0708

Cross-site scripting XSS vulnerability in dopvCOMET 0009b allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log...

CVE-2024-41791

A vulnerability has been identified in SENTRON 7KT PAC1260 Data Manager All versions. The web interface of affected devices does not authenticate report creation requests. This could allow an unauthenticated remote attacker to read or clear the log files on the device, reset the device or set the...

Log Injection

Envoy Gateway is vulnerable to Log Injection. The vulnerability is due to improper log handling due to the use of a default Envoy Proxy access log configuration, allowing attackers to craft user-agent strings that inject and overwrite fields in the access log...

CVE-2025-25294

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...

GHSA-MF24-CHXH-HMVJ Envoy Gateway Log Injection Vulnerability

Impact In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the attacker uses a specially crafted user-agent which performs json injection, then he could add and overwrite fields to th...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-25294

Envoy Gateway has a log injection vulnerability in its default Envoy Proxy access log configuration on affected releases prior to 1.2.7 and 1.3.1. A crafted user-agent could trigger JSON injection, allowing modification of the access log. The issue is fixed in 1.2.7 and 1.3.1 by updating EnvoyPro...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

CVE-2025-25294 Envoy Gateway Log Injection Vulnerability

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This format is vulnerable to log injection attacks. If the...

PT-2025-9996

Name of the Vulnerable Software and Affected Versions: Envoy Gateway versions prior to 1.2.7 Envoy Gateway versions prior to 1.3.1 Description: The issue concerns a default Envoy Proxy access log configuration that is vulnerable to log injection attacks. An attacker can use a specially crafted...

CVE-2024-48939

Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 SR4 enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data...

CVE-2024-48939

Paxton Net2 prior to version 6.07.14023.5015 (SR4) has insufficient validation of the REST API License file, which can allow using the REST API with an invalid license and may enable retrieval of access-log data. Confirmed in multiple sources (NVD, Red Hat, CNVD/CNNVD, PT Security) across CVE-202...

CVE-2024-48939

Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 SR4 enables use of the REST API with an invalid License File. Attackers may be able to retrieve access-log data...