5952 matches found
CVE-2023-27256
Missing authentication in the GetLogFiles method in IDAttend’s IDWeb application 3.1.052 and earlier allows retrieval of sensitive log files by unauthenticated attackers...
CVE-2023-41254: Insertion of Sensitive Information into Log File
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to access sensitive user data...
CVE-2023-40405: Insertion of Sensitive Information into Log File
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensitive location information...
PT-2023-30151 · Elastic · Fleet Server
Name of the Vulnerable Software and Affected Versions: Fleet Server versions 8.10.0 through 8.10.2 Description: An issue was discovered where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into...
CVE-2023-40425: Insertion of Sensitive Information into Log File
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with root privileges may be able to access private information...
CVE-2023-42857: Insertion of Sensitive Information into Log File
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data...
Credential Disclosure Through Logs
github.com/ydb-platform/ydb-go-sdk is vulnerable to Information Disclosure. The vulnerability is due to a custom implementation of the credentials interface. During logging, the credentials are directly serialized into the error message. If an application defines a custom credential interface, an...
Code injection
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...
CVE-2023-45825: Insertion of Sensitive Information into Log File
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object implementation of interface Credentials it may leak into logs. This happens because this object could be serialized into an error message using...
CVE-2023-4089
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected...
CVE-2023-4089
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected...
CVE-2023-4089 WAGO: Multiple products vulnerable to local file inclusion
On affected Wago products an remote attacker with administrative privileges can access files to which he has already access to through an undocumented local file inclusion. This access is logged in a different log file than expected...
CVE-2023-44388
Discourse (open source forum software) is affected by CVE-2023-44388: a malicious request can cause production log files to rapidly fill, leading to disk-space exhaustion. Affected versions: 3.1.1 (stable) and 3.2.0.beta2. The workaround mentioned is reducing the nginx client_max_body_size direct...
CVE-2023-5003
Summary: CVE-2023-5003 affects the Active Directory Integration / LDAP Integration WordPress plugin (pre-4.1.10). The issue cores in storing sensitive LDAP logs in a buffer file created when an administrator exports logs; the buffer file is not removed and can be accessed by anyone who knows the ...
Windows Common Log File System Driver Disclosure
The vulnerability of the Windows Common Log File System CLFS driver in Windows operating systems is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...
F5 Networks BIG-IP APM Guided Configuration Information Disclosure (K47756555)
The version of F5 Networks BIG-IP installed on the remote host is prior to 17.1.0 / 16.1.4 / 15.1.8. It is, therefore, affected by a vulnerability as referenced in the K47756555 advisory. When BIG-IP APM Guided Configuration is configured, undisclosed sensitive information may be logged in the...
Buffer Overflow
libzephyr.so is vulnerable to Buffer Overflows. The vulnerability is caused by the CLFS driver. An attacker is able to exploit this vulnerability by sending a specially crafted log file to a vulnerable system. If the log file is processed by the CLFS driver, the buffer overflow can be triggered,...
platform: ec2_key module prints out the private key directly to the standard output
A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availabili...