CVE-2023-31135 Dgraph Audit Log Encryption nonce reuse

Dgraph is an open source distributed GraphQL database. Existing Dgraph audit logs are vulnerable to brute force attacks due to nonce collisions. The first 12 bytes come from a baseIv which is initialized when an audit log is created. The last 4 bytes come from the length of the log line being...

PT-2023-32943 · Audited · Audited

Name of the Vulnerable Software and Affected Versions: Audited versions 4.0.0 through 5.3.3 Description: A race condition exists in Audited that can result in an authenticated user causing audit log entries to be attributed to another user. This issue is related to Audited's use of Thread.current...

WordPress Shield Security 17.0.17 Cross Site Scripting / Missing Authorization Vulnerability

WordPress Shield Security Smart Bot Blocking and Intrusion Prevention plugin versions 17.0.17 and below suffer from cross site scripting and missing authorization vulnerabilities. Affected Plugin: Shield Security – Smart Bot Blocking & Intrusion Prevention Plugin Slug: wp-simple-firewall Affected...

Shield Security < 17.0.18 - Unauthenticated Stored XSS

The plugin does not escape the User Agent header retrieved via audit log records, which could allow unauthenticated attackers to perform Stored XSS attacks...

CVE-2023-31056

CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x...

Code injection

CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x...

CVE-2023-31056

CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x...

CVE-2023-31056

CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x...

CVE-2023-31056

CVE-2023-31056 affects CloverDX prior to 5.17.3. The issue causes passwords to be written to the audit log when the audit log is enabled and single sign-on is not used, exposing credentials (information disclosure). Fixed versions are 5.15.4, 5.16.2, 5.17.3, and 6.0.x. Exploitation details are no...

CVE-2023-1831

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

CVE-2023-1831 User password logged in audit logs

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...

The vulnerability of the audit log management mechanism of the Secure Access Management System IED Siemens RUGGEDCOM CROSSBOW allows a perpetrator to execute arbitrary SQL queries.

The vulnerability of the audit log management mechanism of the Secure Access Management System for IED Siemens RUGGEDCOM CROSSBOW is related to the failure to implement measures to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL...

CVE-2023-27463

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.3. The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database...

Sql injection

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V5.3. The audit log form of affected applications is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary SQL queries on the server database...

PT-2023-1882 · Unknown · Ruggedcom Crossbow

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM CROSSBOW versions prior to V5.3 Description: A vulnerability has been identified in the audit log form of RUGGEDCOM CROSSBOW, which is vulnerable to SQL injection. This could allow authenticated remote attackers to execute arbitrary...

K15155: OpenSSH vulnerability CVE-2007-3102

Security Advisory Description Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. CVE-2007-3102 Impact None. F5 products...

CVE-2022-43954

An insertion of sensitive information into log file vulnerability CWE-532 in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote authenticated attacker to read other devices' passwords in the audit log page...

FortiPortal - Device password exposure in audit log

An insertion of sensitive information into log file vulnerability CWE-532 in the FortiPortal management interface may allow a remote authenticated attacker to read other devices' passwords in the audit log page...

PT-2023-1544 · Fortinet · Fortiportal

Name of the Vulnerable Software and Affected Versions: FortiPortal versions 7.0.0 through 7.0.2 Description: The issue is related to an insertion of sensitive information into log files, which may allow a remote authenticated attacker to read other devices' passwords in the audit log page. This i...

SUSE CVE-2007-3102

Unspecified vulnerability in the linuxauditrecordevent function in OpenSSH 4.3p2, as used on Fedora Core 6 and possibly other systems, allows remote attackers to write arbitrary characters to an audit log via a crafted username. NOTE: some of these details are obtained from third party informatio...