GHSA-25XJ-89G5-FM6H Information Disclosure in HashiCorp Vault

HashiCorp Vault and Vault Enterprise before 1.3.6, and 1.4.2 before 1.4.2, insert Sensitive Information into a Log File. The vulnerability is affecting github.com/hashicorp/vault/command Go package...

Insertion of Sensitive Information into Log File

The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally, the APM agent will sanitize sensitive HTTP header details before sending the information to the APM server. During an application panic it...

OPENSUSE-SU-2021:0735-1 Security update for nagios

This update for nagios fixes the following issues: - new nagios-exec-start-post script to fix boo1003362 - fix nagiosupgrade.sh writing to log file in user controlled directory boo1182398. The nagiosupgrade.sh script writes the logfile directly below /var/log/ nagios was updated to 4.4.6: Fixed M...

CVE-2021-30183: Cleartext Storage of Sensitive Information

Cleartext storage of sensitive information in multiple versions of Octopus Server where in certain situations when running import or export processes, the password used to encrypt and decrypt sensitive values would be written to the logs in plaintext...

CVE-2021-20331 MongoDB C# Driver may publish events containing authentication-related data to a command listener configured by an application

Specific versions of the MongoDB C Driver may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when commands such as "saslStart", "saslContinue", "isMaster", "createUser",...

OPENSUSE-SU-2021:0715-1 Security update for nagios

This update for nagios fixes the following issues: - new nagios-exec-start-post script to fix boo1003362 - fix nagiosupgrade.sh writing to log file in user controlled directory boo1182398. The nagiosupgrade.sh script writes the logfile directly below /var/log/ nagios was updated to 4.4.6: Fixed M...

CANalyse - A Vehicle Network Analysis And Attack Tool

CANalyse is a tool built to analyze the log files to find out unique datasets automatically and able to connect to simple user interfaces such as Telegram. Basically, while using this tool the attacker can provide a bot-ID and use the tool over the internet through telegram-bot. CANalyse is made ...

CVE-2021-31918

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

Design/Logic Flaw

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

CVE-2021-31918: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in tripleo-ansible version as shipped in Red Hat Openstack 16.1. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality...

PT-2021-19593 · Red Hat · Tripleo-Ansible

Name of the Vulnerable Software and Affected Versions: tripleo-ansible version as shipped in Red Hat Openstack 16.1 Description: A flaw was found in the software, where the Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to...

CVE-2021-31918

A flaw was found in tripleo-ansible. The Ansible log file is readable to all users during stack update and creation. The highest threat from this vulnerability is to data confidentiality. Mitigation This vulnerability can be resolved by manually adjusting the file permissions. Run the following...

SuiteCRM Log File Remote Code Execution

This module exploits an input validation error on the log file extension parameter. It does not properly validate upper/lower case characters. Once this occurs, the application log file will be treated as a php file. The log file can then be populated with php code by changing the username of a...

CVE-2021-20536: Insertion of Sensitive Information into Log File

IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 198836...

CVE-2021-31546: Insertion of Sensitive Information into Log File

An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have been visible to users with access to view AbuseFilter log data...

CVE-2021-1079

NVIDIA GeForce Experience, all versions prior to 3.22, contains a vulnerability in GameStream plugins where log files are created using NT/System level permissions, which may lead to code execution, denial of service, or local privilege escalation. The attacker does not have control over the...

CVE-2021-3037

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS...

Design/Logic Flaw

An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in system logs. Logged information includes the cleartext username, password, and IP address used to export the PAN-OS...

CVE-2021-3037

PAN-OS contains an information exposure where details for scheduled configuration exports (cleartext username, password, IP) are logged in system logs. Root cause: sensitive credentials are written to logs during export; impact is local access to credentials if logs are read. Exploitation details...

CVE-2021-3036

The CVE-2021-3036 issue affects Palo Alto Networks PAN-OS where secrets are logged in cleartext in web server logs when the PAN-OS XML API is used with duplicate API parameters. Affected component: PAN-OS XML API request handling; root cause: logging of administrator credentials (username, passwo...