CVE-2023-6687 Elastic Agent Insertion of Sensitive Information into Log File

An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event that Elastic Agent attempted to ingest,...

PT-2023-8930 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana versions prior to 8.11.2 Description: An issue was discovered whereby sensitive information may be recorded in Kibana logs in the event of an error or when debug level logging is enabled. The messages recorded in the log may contain...

Sensitive Information Leak

kibana is vulnerable to Sensitive Information Leak. The vulnerability is due to sensitive information being recorded to logs in case of an error. The log can contain account credentials for the kibanasystem user, API Keys and credentials of kibana end users...

CVE-2023-40788

SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...

Design/Logic Flaw

SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...

CVE-2023-40788

SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...

CVE-2023-40788

SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...

PT-2023-27638 · Unknown · Springblade

Name of the Vulnerable Software and Affected Versions: SpringBlade versions =V3.6.0 Description: The issue is related to Incorrect Access Control due to an incorrect configuration in the default gateway, resulting in unauthorized access to error logs. Recommendations: For SpringBlade versions...

SpringBlade Security Vulnerability

Bred Network Technology SpringBlade is a suite of microservice development platforms from China's Bred Network Technology. A security vulnerability exists in SpringBlade V3.6.0 and earlier versions, which stems from an incorrect configuration in the default gateway that allows unauthorized...

CVE-2023-40788

SpringBlade =V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthorized access to error logs...

CVE-2023-40788

SpringBlade 3.6.0 to remediate.

Mattermost Resource Management Error Vulnerability (CNVD-2023-55045)

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a resource management error vulnerability that stems from an inability to properly truncate postgres error log messages for failed search queries, which can be exploited by an...

PT-2023-21375 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: Mattermost fails to properly truncate the postgres error log message of a search query failure, allowing an attacker to cause the creation of large log files, which can result in Denial ...

Exploit for Untrusted Search Path in Softexpert Excellence_Suite

Remote Code Execution in SoftExpert Excellence Suite 2.0 - CVE...

CVE-2023-28441

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly...

Design/Logic Flaw

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly...

CVE-2023-28441

CVE-2023-28441 affects smartCARS 3 (versions 0.5.8 and earlier). The root issue is that failed login attempts cause passwords to be stored in error logs. This vulnerability is not present in version 0.5.9. A practical workaround is to delete the affected log file and ensure login is performed cor...

CVE-2023-28441 smartCARS 3 Password Stored as plain text in Error Log

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly...

CVE-2023-28441 smartCARS 3 Password Stored as plain text in Error Log

smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensure one logs in correctly...

PT-2023-21724 · Unknown · Smartcars 3

Name of the Vulnerable Software and Affected Versions: smartCARS 3 versions 0.5.8 and prior Description: The issue affects smartCARS 3, a flight tracking software. In the affected versions, failed login attempts result in passwords being stored in error logs. This does not occur in version 0.5.9...