CVE-2022-29806

CVE-2022-29806 ZoneMinder 1.36.12 までの言語特権昇格（および RCE） 説明 ZoneMinder 1.36.13 より前および 1.37.11 より前のバージョンにおける、デバッグログファイルの Path Traversal とデフォルト言語オプションの脆弱性により、攻撃者は任意のコードを書き込み・実行してリモートコマンド実行を達成できます。 「この概念実証は ZoneMinder 1.36.4 ubuntu18.04 docker: ZoneMinder/zmdockerfiles に対してテストされましたが、最新バージョン 1.36.12...

CVE-2023-40600

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - デバッグログを介した認証不要の機密情報漏洩 説明 EWWW Image Optimizer プラグイン WordPress は、バージョン 7.2.0 以前において、debuglog 関数を介して機密情報が漏洩する脆弱性が存在します。これにより、デバッグログが有効な場合、認証されていない攻撃者が機密デバッグデータを取得できる可能性があります。 root@kitploit: Severity: medium CVE ID: CVE-2023-40600 CVSS Score: 5.3 CVSS...

W3 Total Cache < 2.8.2 - Log File Exposure

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

CVE-2024-44000

EN GenCookieSessionHijack は、WordPressサイトで安全でない形で公開されたデバッグログを悪用してセッションCookieを抽出するために設計されたPoCツールです。これにより、攻撃者はアクティブな管理者セッションを乗っ取り、WordPress管理ダッシュボードへの不正アクセスを得ることができます。 特徴 WordPressのデバッグログからCookieを抽出します。 セッションCookieを識別してフィルタリングします（例：wordpressloggedin）。 管理者アクセスのためにセッションハイジャックを自動的に試行します。...

KasperMeow

Kaspersky arkmon.sys 通过内核调试日志泄露绕过 KASLR Kaspersky 的反 rootkit 监控驱动程序（arkmon.sys）存储了一份包含原始内核指针的内核调试日志。该日志使用 XOR 0xCC + ROT13 进行“加密”——可轻松逆向还原。任何管理员用户都可以通过 IOCTL 读取并解密此日志，从而完全绕过 KASLR。 在撰写本文时，该概念验证可在完全修补的 Windows 11 25H2 及 Kaspersky Standard: K4W-21-26（含最新数据库更新）上运行。...

EUVD-2026-71839

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-83627 Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

CVE-2026-19715

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715

The WP OAuth Server (Login with WordPress) WordPress plugin, in versions before 6.3.1 , fails to restrict access to its debug log file , which is written to a fixed and publicly reachable location. When debug logging is enabled, unauthenticated attackers can read OAuth tokens , authorization code...

EUVD-2026-66876

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

CVE-2026-19715 WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

PT-2026-82392

The WP OAuth Server Login with WordPress WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user...

EUVD-2026-62939

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76374

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

CVE-2026-76375

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-76374 Information Disclosure through Sensitive Data Logging in AD LDAP app for Splunk SOAR

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

PT-2026-78802

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive credentials by invoking an action that causes the full connector process environment to be written to a persistent debug log file in plaintext. For more...

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...

CVE-2026-10773

The DHCPv4 client helper netdhcpv4msgtypename in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const char name table after a faulty bounds check. The guard used msgtype = sizeofname instead of msgtype = ARRAYSIZEname; sizeof returns the byte size of the pointer array 32 on 32-bit, 64 ...