[SECURITY] Fedora 31 Update: log4net-2.0.8-10.fc31

log4net is a tool to help the programmer output log statements to a variety of output targets. log4net is a port of the excellent log4j framework to the .NET runtime...

Juniper Networks Junos OS Evolved Log Message Disclosure Vulnerability (CNVD-2020-29615)

Juniper Networks Junos OS is a Juniper Networks network operating system designed for use with Juniper Networks hardware devices. The operating system provides a secure programming interface and the Junos SDK.Junos OS Evolved is an upgraded version of Junos OS. A log information disclosure...

Juniper Networks Junos OS Evolved Log Message Disclosure Vulnerability

Juniper Networks Junos OS is a Juniper Networks network operating system designed for use with Juniper Networks hardware devices. The operating system provides a secure programming interface and the Junos SDK.Junos OS Evolved is an upgraded version of Junos OS. A log information disclosure...

EasyBuild Log Information Disclosure Vulnerability

EasyBuild is a software building and installation framework. A log information disclosure vulnerability exists in versions of EasyBuild prior to 4.1.2. The vulnerability stems from the abnormal output of log files from a networked system or product. No details of the vulnerability are provided at...

SUSE SLED12 / SLES12 Security Update : ceph (SUSE-SU-2019:2364-1)

This update for ceph to version 12.2.12-594-g02236657ca fixes the following issues : Security issues fixed : CVE-2018-16889: Fixed missing sanitation of customer encryption keys from log output in v4 auth. bsc1121567 Note that Tenable Network Security has extracted the preceding description block...

Sony Smart TVs Information Disclosure Vulnerability

Sony Smart Tvs are smart TV products from Sony Japan. A log information disclosure vulnerability exists in Sony Smart Tvs. The vulnerability originates from the abnormal output of log files from a networked system or product. An attacker could exploit this vulnerability to obtain sensitive...

SUSE-SU-2019:0499-1 Security update for ceph

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-14662: mon: limit caps allowed to access the config store bsc1111177 - CVE-2018-16846: rgw: enforce bounds on max-keys/max-uploads/max-parts bsc1114710 - CVE-2018-16889: rgw: sanitize customer encryption keys from...

Security Bulletin: Secure properties can be shown in plain text in IBM UrbanCode Deploy (CVE-2016-9007)

Summary IBM UrbanCode Deploy could disclose secure property values leaked in process execution log output properties that could be accessable to unauthorized users. Vulnerability Details CVEID: CVE-2016-9007 DESCRIPTION: IBM UrbanCode Deploy could disclose secure property values leaked in process...

PullString: Eternal "change password" link.

Hi. Link for password change does not exprire after first use and may be reused many times, resulting password change every time. The issue is such links leak to google-analytics. I'd suggest expire link after first use. Also you store the link in Log output. This means easy leveraging XSS to...

Format string

Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service...

CVE-2017-17132

Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service...

Multiple vulnerabilities in H2O

Overview H2O is an open source web server software. H2O contains multiple vulnerabilities listed below. A Denial-of-service DoS due to a flaw in processing HTTP/1 header CWE-20 - CVE-2017-10868 Stack-based buffer overflow CWE-121 - CVE-2017-10869 A Denial-of-service DoS due to a flaw in outputtin...

[SECURITY] Fedora 26 Update: log4j12-1.2.17-19.fc26

Log4j is a tool to help the programmer output log statements to a variety of output targets...

Cybozu KUNAI for Android information management vulnerability

Overview Cybozu KUNAI for Android is a mobile client software for using Cybozu from an Android device. Cybozu KUNAI for Android provides a function to output log information when synchronizing data with Cybozu, however the function is disabled by default. Cybozu KUNAI for Android contains an issu...

CVE-2013-5991

The displaySystemError function in html/handleerror.php in LOCKON EC-CUBE 2.11.0 through 2.11.5 allows remote attackers to obtain sensitive information by leveraging incorrect handling of error-log output...