Information disclosure

aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component...

CVE-2019-9734

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...

CVE-2019-9734

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...

CVE-2019-9724

aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component...

CVE-2019-9724

aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component...

'Karkoff' Is the New 'DNSpionage' With Selective Targeting Strategy

The cybercriminal group behind the infamous DNSpionage malware campaign has been found running a new sophisticated operation that infects selected victims with a new variant of the DNSpionage malware. First uncovered in November last year, the DNSpionage attacks used compromised sites and crafted...

CVE-2019-9734: Insertion of Sensitive Information into Log File

Aquarius CMS through 4.3.5 writes POST and GET parameters including passwords to a log file due to an overwriting of configuration parameters under certain circumstances...

CVE-2019-9724: Insertion of Sensitive Information into Log File

aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component...

PT-2019-19822

Name of the Vulnerable Software and Affected Versions aquaverde Aquarius CMS versions through 4.3.5 Description The issue allows information exposure through log files due to an error in the log-file writer component. Recommendations For versions through 4.3.5, update to a version that fixes the...

PT-2019-19829

Name of the Vulnerable Software and Affected Versions Aquarius CMS versions prior to 4.3.6 Description The issue allows Aquarius CMS to write POST and GET parameters, including passwords, to a log file due to an overwriting of configuration parameters under certain circumstances. Recommendations...

Multiple Lenovo Products Information Disclosure Vulnerability

The Lenovo Flex System x240 M4, among others, is a server from the Chinese company Lenovo. A security vulnerability exists in a number of Lenovo products, which stems from FFDC recording the private key of a web server in a log file. An attacker could exploit the vulnerability to disclose...

CVE-2019-6157: Insertion of Sensitive Information into Log File

In various firmware versions of Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server's private key in the generated log file for support...

PT-2019-4139

Name of the Vulnerable Software and Affected Versions Check Point ZoneAlarm versions up to 15.4.062 Check Point Endpoint Security client for Windows versions prior to E80.96 Description The issue is related to errors in permission handling, allowing a local attacker to gain higher privileges to...

IMM2 FFDC includes Private Key - US

Lenovo Security Advisory: LEN-25667 Potential Impact: Information disclosure Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2019-6157 Summary Description: In Lenovo System x, the integrated management module II IMM2's first failure data capture FFDC includes the web server'...

CVE-2019-8455

A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file...

CVE-2019-8455: Windows Hard Link

A hard-link created from the log file of Check Point ZoneAlarm up to 15.4.062 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gains the local attacker higher privileges to the file...

PT-2019-19051

Name of the Vulnerable Software and Affected Versions Check Point ZoneAlarm versions up to 15.4.062 Description A local attacker can gain higher privileges to files with limited access by creating a hard-link from the log file of Check Point ZoneAlarm to any file on the system, resulting in...

BSA-2019-783

Security Advisory ID : BSA-2019-783 Component : VPN Revision : 1.0: Final Virtual Private Networks VPNs are used to create a secure connection with another network over the internet. Multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files...

CVE-2019-3891

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...

Design/Logic Flaw

It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A malicious user with local access to a Satellite host can use those credentials to modify the database and prevent Satellite from fetching...