33 matches found
Sensitive Information Disclosure
github.com/goreleaser/goreleaser is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the change in log output level from DEBUG to INFO, which could allow an attacker with access to the build logs to view sensitive environment information when the go build output is...
GHSA-F6MM-5FC7-3G3C goreleaser shows environment by default
Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...
goreleaser shows environment by default
Summary Since 4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet or run goreleaser later in a container, or...
CVE-2023-49923
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the App Search logs. Elastic has released...
Insertion Of Sensitive Information Into Log File
github.com/juanfont/headscale is vulnerable to Insertion Of Sensitive Information Into Log File. The vulnerability is due the HTTP api writting the whole bearer token to info-level logs...
GHSA-WP76-CF2J-RQQ7 Headscale writes bearer tokens to info-level logs
Headscale through 0.22.3 writes bearer tokens to info-level logs...
Design/Logic Flaw
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-47390
Headscale up to 0.22.3 stores bearer tokens in info‑level logs via the HTTP API, exposing credentials in logs. Multiple connected sources corroborate that tokens are written to logs when accessing the API, with the root cause described as logging sensitive data. Affected: Headscale; component: HT...
CVE-2023-47390
Headscale through 0.22.3 writes bearer tokens to info-level logs...
CVE-2023-46653
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure...
Cross site request forgery (csrf)
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure...