PT-2024-14712 · Kde · Libksieve

Name of the Vulnerable Software and Affected Versions: KDE libksieve versions prior to 23.03.80 Description: The issue arises from a mistake in kmanagesieve/session.cpp where a username variable is accidentally assigned a password value, resulting in cleartext passwords being placed in server log...

PT-2024-24600

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 24.4.1 Description Sentry is an error tracking and performance monitoring platform. When authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event...

Nozomi Networks Guardian/CMC 安全漏洞

Nozomi Networks Guardian/CMC is a centralized management console from Nozomi Networks, USA. A security vulnerability exists in Nozomi Networks Guardian/CMC versions prior to v23.4.1 that stems from an audit log of an OpenAPI request that may contain sensitive information, which could lead to...

PT-2024-19637 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – Sell Digital Files & Subscriptions plugin for WordPress versions up to, and including, 3.2.9 Description: The issue allows unauthenticated attackers to download the debug log via Directory Listing, potentially exposin...

PT-2024-19195 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered where cleartext passwords and hashes are exposed through log files. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and...

CVE-2024-20292

A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of an unencrypted registry key in certain...

CVE-2024-23758

An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstallermsi.log file...

IBM Cloud Pak for Security Log Information Disclosure Vulnerability

IBM Cloud Pak for Security is an application from International Business Machines IBM, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enable you to take automated action faster. A log information disclosure vulnerability exists in IBM...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

Shanxi Diankeyun Technology NODERP Security Vulnerability

Shanxi Diankeyun Technology NODERP is an ERP system from Shanxi Diankeyun Technology. A security vulnerability exists in Shanxi Diankeyun Technology NODERP version 6.0.2, which stems from an issue with the file /runtime/log, which could result in an accessible file or directory...

PT-2024-4789

Name of the Vulnerable Software and Affected Versions: VMware Cloud Director Object Storage Extension affected versions not specified Description: The issue concerns an Insertion of Sensitive Information, where a malicious actor with adjacent access to web/proxy server logging may obtain sensitiv...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

CVE-2023-6746

An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the...

Google nodejs-firestore Security Vulnerability

Google nodejs-firestore is a NoSQL document database by Google, Inc. A security vulnerability exists in Google nodejs-firestore versions prior to 6.1.0, which stems from the presence of potential logging that could be exposed to anyone with log read access...

CVE-2023-25682

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 247034...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Ewww Image_Optimizer

CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - Unauthentica...

PT-2023-8572 · N Able · N-Able Passportal Extension

Name of the Vulnerable Software and Affected Versions: N-able PassPortal extension versions prior to 3.29.2 for Chrome Description: The issue is related to insufficient protection of registration data, which may allow an attacker to gain unauthorized access to protected information. The N-able...

YDB Log Information Disclosure Vulnerability

YDB is an open source distributed SQL database open-sourced by YDB Platform. A security vulnerability exists in the YDB ydb-go-sdk v3.48.6 version, which stems from the fact that if you use a custom credentials object, it may leak into the logs...

CVE-2023-5003

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so...

Scrutinizer NetFlow & sFlow Analyzer Log Information Disclosure Vulnerability

Plixer Scrutinizer NetFlow & sFlow Analyzer is a network traffic analysis system from Plixer, USA. The system provides traffic monitoring, context forensics, and security analysis. A security vulnerability exists in Scrutinizer NetFlow & sFlow Analyzer versions prior to 19.3.1, which stems from a...