Security Bulletin: IBM Security Guardium Key Lifecycle Manager has multiple vulnerabilities

Summary Multiple security vulnerabilities have been addressed in an update for IBM Security Guardium Key Lifecycle Manager. Vulnerability Details CVEID:CVE-2024-49817 DESCRIPTION: IBM Security Guardium Key Lifecycle Manager stores user credentials in configuration files which can be read by a loc...

CVE-2024-10544

The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in...

CVE-2024-10544

CVE-2024-10544 – Woo Manage Fraud Orders (WordPress) Affected software: Woo Manage Fraud Orders plugin for WordPress, versions up to and including 6.1.7. Vulnerability: Unauthenticated exposure of sensitive user information via publicly accessible log files. Impact: Potential disclosure of potent...

CVE-2024-10544 Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files

The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information about users contained in...

WordPress Woo Manage Fraud Orders plugin <= 6.1.7 - Unauthenticated Information Exposure via Log Files vulnerability

Unauthenticated Information Exposure via Log Files vulnerability discovered by Colin Xu in WordPress Plugin Woo Manage Fraud Orders versions = 6.1.7...

PT-2024-16358 · WordPress · Woo Manage Fraud Orders

Name of the Vulnerable Software and Affected Versions: Woo Manage Fraud Orders plugin for WordPress versions 6.1.7 and earlier Description: The issue allows unauthenticated attackers to view potentially sensitive information about users contained in publicly exposed log files. This is possible du...

CVE-2024-8852

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

CVE-2024-8852

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

CVE-2024-8852

The CVE-2024-8852 entry concerns the All-in-One WP Migration and Backup plugin for WordPress. Affected versions are up to and including 7.86 (per NVD/WP sources) with unauthenticated information disclosure due to publicly accessible error.log files or log data, enabling disclosure of potentially ...

CVE-2024-8852 All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.86 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information such as full...

PT-2024-39276

Name of the Vulnerable Software and Affected Versions: All-in-One WP Migration and Backup plugin for WordPress versions up to, and including, 7.86 Description: The issue allows unauthenticated attackers to view potentially sensitive information, such as full paths, contained in publicly exposed l...

CVE-2024-9364

The SendGrid for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wpmailplusclearlogs' function in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2024-9364

CVE-2024-9364 affects the SendGrid for WordPress plugin for WordPress (all versions

CVE-2024-38862 SNMP and IMPI secrets written to audit log

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35, 2.1.0p48 and =2.0.0p39 EOL causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators...

Optimizing and Maintaining SQL Server Instance Hosting Veeam Service Provider Console Configuration Database

Purpose This article was produced in coordination with the Veeam R&D team to provide Service Providers with a comprehensive list of the most common performance improvements and maintenance actions relating to the underlying Microsoft SQL Server instance that hosts the Veeam Service Provider Conso...

CVE-2024-8264

Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled...

PT-2025-2807 · Flexon · Flexon

Name of the Vulnerable Software and Affected Versions: FLEXON versions = 9.3.4 Description: The issue is related to the insertion of sensitive information into log files, potentially leading to improper disclosure of certain information through https access. This could allow a remote attacker to...

CVE-2024-41922

A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...

CVE-2024-41922

Veertu Anka Build 1.42.0 contains a directory traversal vulnerability in the log files download functionality. Talos TALOS-2024-2061 reports that the registry log server builds log file paths by concatenating the service parameter without validating directory traversal sequences (e.g., ../), then...

CVE-2024-41922

A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can make an unauthenticated HTTP request to trigger this vulnerability...