Information disclosure

In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser activity with User execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android...

IBM API Connect Log Information Disclosure Vulnerability

IBM API Connect APIConnect is a suite of integrated solutions for managing the API lifecycle from IBM USA. The product supports creating, running, managing, and securing APIs, microservices, and more. A log information disclosure vulnerability exists in IBM API Connect. An attacker could exploit...

IBM Cloud Private Log Information Disclosure Vulnerability (CNVD-2019-27446)

IBM Cloud Private is a set of enterprise private cloud solutions from IBM USA. The product is built primarily on Kubernetes and container technology. A log information disclosure vulnerability exists in IBM Cloud Private, which can be exploited by a local attacker to obtain sensitive OIDC tokens...

Octopus Deploy Log Message Disclosure Vulnerability

Octopus Deploy is an automation tool for .NET, Java and other application development and deployment from Octopus Deploy Australia. Octopus Deploy suffers from a log information disclosure vulnerability that originates when the program writes the Web Request Proxy password in plaintext to the...

TronLink Wallet Log Information Disclosure Vulnerability

TronLink Wallet is a cryptocurrency wallet application. A log information disclosure vulnerability exists in TronLink Wallet version 2.2.0, which originates when the CreateWalletTwoActivity class is called and the program stores the user's password in a log via the registry, which can be exploite...

CVE-2019-10194

CVE-2019-10194 affects ovirt-engine-metrics in Red Hat Virtualization Manager. The issue is disclosure of sensitive passwords used in deployment and configuration of oVirt Metrics, reported as insufficiently protected so passwords could be exposed in log files or in playbooks stored on Metrics or...

Red Hat OpenShift Log Message Disclosure Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that supports building, testing, deploying and running applications. A log information disclosure vulnerability exists in Red Hat OpenShift. The vulnerability stems from errors such as configuration duri...

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the nolog task flag for failed tasks. When the nolog flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on th...

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the nolog task flag for failed tasks. When the nolog flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on th...

CVE-2018-1117

CVE-2018-1117 affects ovirt-ansible-roles prior to 1.0.6. The issue comes from a missing no_log directive, causing admin passwords to be disclosed in the provisioning log when adding an oVirt provider to ManageIQ/CloudForms. Impact is information disclosure with potential privilege escalation in ...

Spoofing

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-11398

CVE-2017-11398 affects Trend Micro Smart Protection Server (Standalone)

CVE-2017-11398

A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server Standalone versions 3.2 and below could allow an unauthenticated attacker to hijack active user sessions to perform authenticated requests on a vulnerable system...

CVE-2017-6139

In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Details in the log file can vary; customers running debug mode logging with BIG-IP APM are at highest risk...

Trend Micro Smart Protection Server - Session Hijacking Log File Disclosure Remote Command Execution Cron Job Injection Local File Inclusion Stored Cross-Site Scripting Improper Access Control

Trend Micro Smart Protection Server - Session Hijacking Log File Disclosure Remote Command Execution Cron Job Injection Local File Inclusion Stored Cross-Site Scripting Improper Access Control Trend Micro Smart Protection Server Multiple Vulnerabilities 1. Advisory Information Title:: Trend Micro...

Cisco HyperFlex System system logging information disclosure vulnerability

Cisco HyperFlex System is the United States Cisco Cisco a data platform equipment. system logging is one of the system logger. An information disclosure vulnerability exists in system logging on the Cisco HyperFlex System, which arises from the program's failure to properly mask sensitive...

Slack: Unauthenticated LFI revealing log information

@juji found a bug which allowed the disclosure of local files on certain servers - this included PHP files and logs. We performed a thorough investigation to ensure that this issue was not exploited, and as a precaution revoked tokens which were inadvertently logged. Thanks @juji! Write-up...

Cybozu KUNAI for Android information management vulnerability

Overview Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issu...