CVE-2024-29291

The Laravel Framework (versions 8 through 11 ) contains a vulnerability where a remote attacker might discover database credentials stored in the storage/logs/laravel.log file. The root cause is attributed to the insufficient protection of sensitive data during the processing of log files. An exp...

CVE-2024-29291

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the...

Laravel Framework 安全漏洞

Laravel Framework is a PHP-based web application development framework from the individual developer Taylor Otwell. A security vulnerability exists in Laravel Framework versions 8 through 11, which stems from a vulnerability that allows a remote attacker to discover database credentials in...

CVE-2024-29291: Exposure of Sensitive Information to an Unauthorized Actor

An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. NOTE: this is disputed by multiple third parties because the owner of a Laravel Framework installation can choose to have debugging logs, but needs to set the...

CVE-2024-3706

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

CVE-2024-3706 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsys

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

CVE-2024-3706

OpenGnsys, version 1.1.1d (Espeto), contains an information exposure vulnerability where an attacker can view the php backup file controlaccess.php-LAST, which stores database credentials. The issue is documented across multiple sources (NVD/CVE records) as a vulnerability with network-based acce...

OpenGnsys 信息泄露漏洞

OpenGnsys is an open source computing device management software from the Spanish OpenGnsys project. An information disclosure vulnerability exists in OpenGnsys version 1.1.1d Espeto, which stems from the presence of an information exposure vulnerability that allows an attacker to view a php back...

CVE-2024-3706: Exposure of Sensitive Information to an Unauthorized Actor

Information exposure vulnerability in OpenGnsys affecting version 1.1.1d Espeto. This vulnerability allows an attacker to view a php backup file controlaccess.php-LAST where database credentials are stored...

PT-2024-27275 · Opengnsys · Opengnsys

Name of the Vulnerable Software and Affected Versions: OpenGnsys version 1.1.1d Espeto Description: The issue allows an attacker to view a php backup file, specifically controlaccess.php-LAST, where database credentials are stored. This is an information exposure vulnerability. Recommendations: F...

CVE-2024-3165 Database Credential Exposure in the Logs

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

CVE-2024-3165: Insertion of Sensitive Information into Log File

System-Maintenance- Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05 Insecure Design OWASP Top...

PT-2024-24175 · Dotcms · Dotcms

Name of the Vulnerable Software and Affected Versions: dotCMS affected versions not specified Description: The issue is related to the System-Maintenance- Log Files in the dotCMS dashboard, which is providing the username/password for database connections in the log output. This is considered a...

DotCMS 安全漏洞

DotCMS is an open source content management system written in Java by DotCMS, Inc. for managing content and content-driven sites and applications. A security vulnerability exists in DotCMS that originates in the log files that provide usernames and passwords for database connections...

CVE-2023-50894

In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function allows remote authenticated administrative users to discover cleartext database credentials contained in error report information...

CVE-2023-50894

In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function allows remote authenticated administrative users to discover cleartext database credentials contained in error report information...

CVE-2023-50894

In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password encryption function allows remote authenticated administrative users to discover cleartext database credentials contained in error report information...

CVE-2024-25649

In Delinea PAM Secret Server 11.4, it is possible for an attacker with Administrator access to the Secret Server machine to read the following data from a memory dump: the decrypted master key, database credentials when SQL Server Authentication is enabled, the encryption key of RabbitMQ queue...

PT-2024-21064

Name of the Vulnerable Software and Affected Versions Delinea PAM Secret Server version 11.4 Description The issue allows an attacker with Administrator access to the Secret Server machine to read sensitive data from a memory dump, including the decrypted master key, database credentials when SQL...

CVE-2024-1302

Information exposure vulnerability in Badger Meter Monitool affecting versions up to 4.6.3 and earlier. A local attacker could change the application's file parameter to a log file obtaining all sensitive information such as database credentials...