Nginx 'access.log'不安全文件权限漏洞

BUGTRAQ ID: 58105 CVECAN ID: CVE-2013-0337 nginx是一款使用非常广泛的高性能Web服务器。 在Gentoo上，/var/log/nginx全局可访问，目录内的日志文件也是全局可读，这可允许未授权用户读取日志文件。 0 Igor Sysoev nginx 厂商补丁： Igor Sysoev ----------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://nginx.net/...

Information disclosure

The Weathernews Touch application 2.3.2 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files...

CVE-2012-5187

The Weathernews Touch application 2.3.2 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files...

Weathernews Touch for Android stores location information in the system log file

Overview Weathernews Touch for Android contains a vulnerability that stores location information in the system log file. Weathernews Touch provided by Weathernews Inc. is a weather forecast application. Weathernews Touch for Android contains a vulnerability that stores location information in the...

Design/Logic Flaw

Apache CloudStack 4.0.0-incubating and Citrix CloudPlatform formerly Citrix CloudStack before 3.0.6 stores sensitive information in the log4j.conf log file, which allows local users to obtain 1 the SSH private key as recorded by the createSSHKeyPair API, 2 the password of an added host as recorde...

Apache CloudStack本地信息泄露漏洞

BUGTRAQ ID: 57259 CVECAN ID: CVE-2012-5616 Apache CloudStack是部署和管理大型虚拟机网络的开源软件。 Apache CloudStack 4.0.0-incubating及其他版本存在安全漏洞，本地用户可利用此漏洞泄露敏感信息。 1） createSSHKeyPair API命令内存在错误，此命令将新建的SSH密钥存储在日志文件中，可造成密钥泄露。 2）AddHost API呼叫将某些信息记录在日志文件内，可造成泄露已添加主机的密码。 3）DeployVM和ResetPasswordForVM...

[SECURITY] Fedora 17 Update: fail2ban-0.8.8-1.fc17

Fail2ban scans log files like /var/log/pwdfail or /var/log/apache/errorlog and bans IP that makes too many password failures. It updates firewall rules to reject the IP address...

Design/Logic Flaw

Apt 0.8.16exp5ubuntu13.x before 0.8.16exp5ubuntu13.6, 0.8.16exp12ubuntu10.x before 0.8.16exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by...

CVE-2012-5183

The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files...

Information disclosure

The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files...

CVE-2012-5183

The Loctouch application 3.4.6 and earlier for Android allows attackers to obtain sensitive information about logged locations via a crafted application that leverages read permission for system log files...

JVN#33159152: Loctouch for Android information management vulnerability

Loctouch provided by NHN Japan, is an application that logs location information. Loctouch for Android contains an information management vulnerability. Impact Android applications with permission to read system log files may obtain log information stored by the product that are intended to be...

Fedora Update for gnome-system-log FEDORA-2012-18659

Check for the Version of gnome-system-log OpenVAS Vulnerability Test Fedora Update for gnome-system-log FEDORA-2012-18659 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or...

[SECURITY] Fedora 17 Update: gnome-system-log-3.4.1-3.fc17

gnome-system-log lets you view various log files on your system...

[SECURITY] Fedora 18 Update: gnome-system-log-3.6.1-2.fc18

gnome-system-log lets you view various log files on your system...

CreateSupportZipAction directory traversal

There’s a directory traversal vulnerability in the CreateSupportZipAction action that allows a malicious user to include arbitrary log files into a support zip. This is because the SupportUtility object is marked as @ParameterSafe, and no validation is performed on its serverLogsDirectory path...

CreateSupportZipAction directory traversal

There’s a directory traversal vulnerability in the CreateSupportZipAction action that allows a malicious user to include arbitrary log files into a support zip. This is because the SupportUtility object is marked as @ParameterSafe, and no validation is performed on its serverLogsDirectory path...

KingView Log File Parsing Buffer Overflow

This module exploits a vulnerability found in KingView use exploit/windows/fileformat/kingview/kingmesskvl msf undefinedkingmesskvl show actions ...actions... msf undefinedkingmesskvl set ACTION msf undefinedkingmesskvl show options ...show and set options... msf undefinedkingmesskvl run This...

Microsoft Internet Information Services security vulnerabilities

log files information leakage, FTP STARTTLS session command injection...

Monaca Debugger for Android information management vulnerability

Overview Monaca Debugger for Android contains an information management vulnerability. Monaca Debugger provided by Asial Corporation contains an issue where account information of the product or other information such as session IDs are saved in a log file. KuMaGa ShiRoIHi reported this...