PT-2022-5571 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a buffer overflow in memory in the Windows Common Log File System Driver, which can allow an attacker to execute arbitrary code with system privileges. It is a...

CVE-2022-39821: Insertion of Sensitive Information into Log File

In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem...

CVE-2022-35803: Undefined Security Weakness

Windows Common Log File System Driver Elevation of Privilege Vulnerability...

ovirt-log-collector: RHVM admin password is logged unfiltered

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

CVE-2022-2438

The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$logfile' value in versions up to, and including 1.11.16. This makes it possible for authenticated attackers with administrative privileges and above to call files using a PHAR wrapper that...

PT-2022-4704 · Cognex · Cognex 3D-A1000 Dimensioning System

Name of the Vulnerable Software and Affected Versions: Cognex 3D-A1000 Dimensioning System versions 1.0.3 3354 and prior Description: The issue is related to improper output neutralization for logs, which can be exploited by a remote attacker to create arbitrary log files. This can lead to the...

PT-2022-16657 · WordPress · Broken Link Checker

Name of the Vulnerable Software and Affected Versions: Broken Link Checker plugin for WordPress versions up to, and including 1.11.16 Description: The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the $log file value. This allows authenticated...

PT-2022-22148 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 9.0.0 up to and including 9.1.0.20 Dell PowerScale OneFS version 9.2.1.13 Dell PowerScale OneFS version 9.3.0.6 Dell PowerScale OneFS version 9.4.0.3 Description: The issue concerns the insertion of sensitive...

CVE-2022-34369: Insertion of Sensitive Information into Log File

Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading to exposure of this sensitive data...

CVE-2022-39046

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

Heap overflow

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

CVE-2022-39046

An issue was discovered in the GNU C Library glibc 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap...

PT-2022-10086 · Ericsson · Ericsson Network Manager

Name of the Vulnerable Software and Affected Versions: Ericsson Network Manager versions prior to 21.2 Description: The issue allows users belonging to the same AMOS authorization group to retrieve data from certain log files, potentially leading to privilege escalation. All AMOS users are...

CVE-2021-32570: Insertion of Sensitive Information into Log File

In Ericsson Network Manager ENM releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All AMOS users are considered to be highly privileged users in ENM system and all must be previously defined and authorized by the Security...

CVE-2022-29550

CVE-2022-29550 affects Qualys Cloud Agent 4.8.0-49 and concerns logging of ps auxwwe output to /var/log/qualys/qualys-cloud-agent-scan.log. The issue could expose credentials from environment variables in the log if verbose tracing is enabled; the vendor notes the ps data collection is intentiona...

PT-2022-19693 · Qualys · Qualys Cloud Agent

Name of the Vulnerable Software and Affected Versions: Qualys Cloud Agent version 4.8.0-49 Description: An issue was discovered in Qualys Cloud Agent where it writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may unexpectedly write credentials from environmen...

[APPFW]"File too large" raises when upgrading appfw default signature "*Default Signatures"

Error "File too large" raises when to upgrade default signatures to version 89V89 On GUI Log sample could be seen in ns.log Jul 25 09:09:18 12 httpd: 49801 Netscalerip 127.0.0.1 - User nsroot - Remoteip 127.0.0.1 - Method POST - Command "params": "warning": "YES" "systemfile": "filename":...

OESA-2022-1825 kexec-tools security update

kexec-tools provides /sbin/kexec binary that facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. This package contains the /sbin/kexec binary and ancillary utilities that together form the userspace component of the kernel's kexec feature...

CVE-2022-2806

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

CVE-2022-2805

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss...