SUSE CVE-2016-6136

Race condition in the auditlogsingleexecvearg function in kernel/auditsc.c in the Linux kernel through 4.7 allows local users to bypass intended character-set restrictions or disrupt system-call auditing by changing a certain string, aka a "double fetch" vulnerability...

SUSE CVE-2019-2741

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: Audit Log. Supported versions that are affected are 5.7.26 and prior and 8.0.16 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

CVE-2022-40004

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

Cross site scripting

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

CVE-2022-40004

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

CVE-2022-40004

CVE-2022-40004 concerns a Cross Site Scripting (XSS) flaw in Things Board 3.4.1. Publicly documented details in the connected sources indicate that a crafted URL to the Audit Log can be used by a remote attacker to escalate privileges. The risk is described with high/severe impact in CVSS metrics...

Thingsboard 跨站脚本漏洞

Thingsboard is a Java-based platform for IOT devices for monitoring, management, and data collection from the Thingsboard team. A security vulnerability exists in Thingsboard version 3.4.1, which stems from the presence of cross-site scripting XSS that allows a remote attacker to elevate privileg...

CVE-2022-40004

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

CVE-2022-40004

Cross Site Scripting XSS vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log...

PT-2022-25162 · Unknown · Thingsboard

Name of the Vulnerable Software and Affected Versions: Things Board version 3.4.1 Description: The issue is related to a Cross Site Scripting XSS vulnerability that allows remote attackers to escalate privileges. This is achieved by crafting a URL to the Audit Log. Recommendations: For version...

When setting a customer account's password, the potentially different&existing logged in user/session will be used in audit log to record the password change, causing confusion and making it look like a password hijack

h1. Steps to reproduce Consider the following scenario: User A: Invite is sent to [email protected] to join the JSM customer portal. User B is a customer and it is logged into customer portal as [email protected]. In the same browser where User B is logged in, the mailbox of [email protected] is open and ...

CVE-2022-39351

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

Design/Logic Flaw

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

PT-2022-24920 · Unknown · Dependency-Track

Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.6.0 Description: The issue allows actors with access to the audit log to exploit a flaw and gain access to valid API keys. This occurs when an API request is made using a valid API key with insufficient...

CVE-2022-39351 Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit...

CVE-2022-31861

Cross site Scripting XSS in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs...

Design/Logic Flaw

A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings values in logs such as the audit log or deployment logs in the Logging and Monitoring cluster. The affected APIs are PATCH /api/v1/user a...

GLSA-202208-09 : HashiCorp Consul: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-09 HashiCorp Consul: Multiple Vulnerabilities - HashiCorp Consul Enterprise version 1.7.0 up to 1.8.4 includes a namespace replication bug which can be triggered to cause denial of service via infinite Raft writes. Fixed in...