Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

...

Cilium 日志信息泄露漏洞

Cilium is an open source software. It is used to provide and transparently secure network connectivity and load balancing between application workloads such as application containers or processes. A logging information disclosure vulnerability exists in Cilium that stems from Cilium logging...

CVE-2023-29002: Insertion of Sensitive Information into Log File

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the cilium-secrets namespace. This could include data such as TLS private keys for Ingress and GatewayAPI resources. An attacker with access to debug...

PT-2023-22078 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions prior to 1.11.16 Cilium versions prior to 1.12.9 Cilium versions prior to 1.13.2 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log t...

Terminalfour Information Disclosure Vulnerability

Terminalfour is a digital marketing and web content management platform for higher education from Terminalfour, Inc. Terminalfour suffers from an information disclosure vulnerability that stems from insufficient protection of sensitive information when debug logging is enabled. An attacker could...

Privilege Escalation

github.com/etcd-io/etcd is vulnerable to Privilege Escalation. The vulnerability exists due to improper authentication in v3server.go which allows an attacker to gain escalated privilege when the log level is set to debug...

RUSTSEC-2023-0035 Adverserial use of `make_bitflags!` macro can cause undefined behavior

The macro relied on an expression of the form Enum::Variant always being a variant of the enum. However, it may also be an associated integer constant, in which case there's no guarantee that the value of said constant consists only of bits valid for this bitflag type. Thus, code like this could...

Adverserial use of `make_bitflags!` macro can cause undefined behavior

The macro relied on an expression of the form Enum::Variant always being a variant of the enum. However, it may also be an associated integer constant, in which case there's no guarantee that the value of said constant consists only of bits valid for this bitflag type. Thus, code like this could...

CVE-2023-29193

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-29193: Generation of Error Message Containing Sensitive Information

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-27703

The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface...

CVE-2023-27703

The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface...

Information disclosure

The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface...

CVE-2023-23591

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

Design/Logic Flaw

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

CVE-2023-27703: Undefined Security Weakness

The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface...

CVE-2023-23591

CVE-2023-23591 affects Terminalfour’s Logback component. An information disclosure vulnerability allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. Fixed releases are Terminalfour 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1. The i...

CVE-2023-23591: Insertion of Sensitive Information into Log File

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

CVE-2023-23591

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

PT-2023-21299 · Pikpak · Pikpak

Name of the Vulnerable Software and Affected Versions: pikpak version 1.29.2 Description: The Android version of pikpak was discovered to contain an information leak via the debug interface. Recommendations: For pikpak version 1.29.2, consider disabling the debug interface as a temporary workarou...