Multiple Siemens Products Log Output Medium and Error Vulnerabilities

SCALANCE M-800, MUM-800 and S615 and RUGGEDCOM RM1224 are industrial routers. A log output neutralization error vulnerability exists in multiple Siemens products, which can be exploited by an attacker to send spam to the openvpn logs, causing a high CPU load...

MGASA-2024-0328 Updated php packages fix security vulnerabilities

HTTPREDIRECTSTATUS might be controlled via user request FPM log output might be modified by an attacker HTTP POST can be modified by an attacker For other bug fixes consult references...

Updated php packages fix security vulnerabilities

HTTPREDIRECTSTATUS might be controlled via user request FPM log output might be modified by an attacker HTTP POST can be modified by an attacker For other bug fixes consult references...

Mageia: Security Advisory (MGASA-2024-0328)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

(Pwn2Own) Phoenix Contact CHARX SEC-3100 OCPP Protocol Improper Log Output Neutralization Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to injection malicious content into log files on affected installations of Phoenix Contact CHARX SEC-3100 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of logging. The...

GHSA-V6MG-7F7P-QMQP apko Exposure of HTTP basic auth credentials in log output

Summary Exposure of HTTP basic auth credentials from repository and keyring URLs in log output Details There was a handful of instances where the apko tool was outputting error messages and log entries where HTTP basic authentication credentials were exposed for one of two reasons: 1. The%s verb...

apko Exposure of HTTP basic auth credentials in log output

Exposure of HTTP basic auth credentials from repository and keyring URLs in log output...

CVE-2024-36127 apko Exposure of HTTP basic auth credentials in log output

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

CVE-2024-28072

A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly...

CVE-2024-28072

A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly...

CVE-2024-28072 Arbitrary File Overwrite Vulnerability

A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly...

CVE-2024-28072

SolarWinds Serv-U FTP Server is affected by CVE-2024-28072: a highly privileged account can overwrite arbitrary files via log output due to unsanitized log file path tags. Affected versions include 15.4.0–15.4.2 (HF1). Remediation: upgrade to 15.4.3 or apply 15.4.2 HF1 where available.

CVE-2023-39461 Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability

Triangle MicroWorks SCADA Data Gateway Event Log Improper Output Neutralization For Logs Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to write arbitrary files on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required...

SolarWinds Serv-U 15.4.0 < 15.4.3

The version of SolarWinds Serv-U installed on the remote host is prior to 15.4.2 HF1. It is, therefore, affected by a vulnerability as referenced in the serv-u1542hotfix1 advisory. - A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags we...

flask-cors 安全漏洞

Flask-CORS is a cross-origin resource sharing component for Flask. A security vulnerability exists in flask-cors, which stems from improper neutralization of log output, allowing an attacker to corrupt log files, potentially masking the trail of other attacks, obfuscating log processing tools, an...

The vulnerability of the add-on for creating supplements to integrate external data sources with the Splunk Add-on Builder platform arises from improper processing of output data for registration logs. This allows a perpetrator to insert arbitrary information into the log files.

The vulnerability in the add-on for creating supplements to integrate external data sources with the Splunk Add-on Builder platform is related to incorrect processing of output data for registration logs. Exploiting this vulnerability allows a malicious actor to write arbitrary information into t...

Fortinet FortiWeb Log injection (FG-IR-23-256)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-256 advisory. - An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5...

CVE-2024-0987

A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The...

Sichuan Yougou Technology KuERP Security Breach

Sichuan Yougou Technology KuERP is an e-commerce platform from Sichuan Yougou Technology, a Chinese company. A security vulnerability exists in Sichuan Yougou Technology KuERP 1.0.4 and prior versions, which stems from an unknown function in /runtime/log that results in improperly neutralized log...

CVE-2023-46033

D-Link Non-US DSL-2750U N300 ADSL2+ and Non-US DSL-2730U N150 ADSL2+ are vulnerable to Incorrect Access Control. The UART/Serial interface on the PCB, provides log output and a root terminal without proper access control...