CVE-2024-36509

An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted password...

CVE-2024-36509

An exposure of sensitive system information to an unauthorized control sphere vulnerability CWE-497 in FortiWeb version 7.6.0, version 7.4.3 and below, version 7.2.10 and below, version 7.0.10 and below, version 6.3.23 and below may allow an authenticated attacker to access the encrypted password...

PT-2024-27040 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.23 and below FortiWeb versions 7.0.10 and below FortiWeb versions 7.2.10 and below FortiWeb versions 7.4.3 and below FortiWeb version 7.6.0 Description: The issue allows an authenticated attacker to access the encrypted...

Apache Airflow 安全漏洞

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache USA Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 2.10.3, which stems from a vulnerabili...

The vulnerability of the RtsPer.sys and RtsUer.sys drivers of Realtek SD card readers is related to insufficient protection of registration data. This allows attackers to access the driver logs.

The vulnerability of the RtsPer.sys and RtsUer.sys drivers of Realtek SD card readers is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to access the driver logs...

CVE-2024-40091

Vilo 5 Mesh WiFi System = 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated attackers to retrieve logs with sensitive system...

PT-2024-11911 · Freemius · Freemius Sdk

Name of the Vulnerable Software and Affected Versions: Freemius SDK versions up to, and including 2.4.2 Freemius SDK versions prior to 2.4.3 Description: The issue concerns Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the...

PT-2024-38899 · Fortra · Robot Schedule Enterprise Agent

Name of the Vulnerable Software and Affected Versions: Fortra's Robot Schedule Enterprise Agent versions prior to 3.05 Description: The issue concerns the writing of FTP username and password information to the agent log file when detailed logging is enabled. This affects the security of the syst...

GHSA-JQH2-CH7P-XWXH Quarkus CXF logs passwords and other secrets

A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging...

PT-2024-13336 · Ibm · Ibm Cloud Pak For Multicloud Management

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management versions 2.3 through 2.3 FP8 Description: The issue concerns the storage of user credentials in log files in plain clear text, which can be accessed by a privileged user. This results in the exposure of...

PT-2024-9821 · Fortinet · Fortiedr Manager Api

Name of the Vulnerable Software and Affected Versions: FortiEDR Manager API versions 6.0 through 6.2.2 Description: The issue is related to improper access control, allowing an authenticated admin with REST API permissions, restricted to a specific organization, to access backend logs that includ...

CVE-2024-5916

An information exposure vulnerability in Palo Alto Networks PAN-OS software enables a local system administrator to unintentionally disclose secrets, passwords, and tokens of external systems. A read-only administrator who has access to the config log, can read secrets, passwords, and tokens to...

PT-2024-37238 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS versions prior to 10.2.8 Palo Alto Networks PAN-OS versions prior to 11.0.4 Description: An information exposure issue in the software enables a local system administrator to unintentionally disclose secrets,...

PT-2024-7410 · Siemens · Scalance Mum856-1 +13

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions V8.1 RUGGEDCOM RM1224 LTE4G NAM versions V8.1 SCALANCE M804PB versions V8.1 SCALANCE M812-1 ADSL-Router family versions V8.1 SCALANCE M816-1 ADSL-Router family versions V8.1 SCALANCE M826-2 SHDSL-Router...

ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command

Summary The issue here is that we pass the secret content as one of the args via CLI. This issue may affect any of our charms that are using: Juju =3.0, Juju secrets and not correctly capturing and processing subprocess.CalledProcessError. There are two points that may log this command, in...

PT-2024-15291 · Yugabyte · Yugabyte Platform

Name of the Vulnerable Software and Affected Versions: Yugabyte Platform affected versions not specified Description: The issue concerns information exposure in the logging system, allowing local attackers with access to application logs to obtain database user credentials in log files. This coul...

PT-2024-5025 · Unknown +2 · Kubernetes +2

Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to 1.27.16 Kubernetes versions prior to 1.28.12 Kubernetes versions prior to 1.29.7 Kubernetes versions prior to 1.30.4 Description: A security issue was discovered in Kubernetes clusters with Windows nodes where...

PT-2024-28016 · Sonarqube · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarQube versions prior to 10.4 SonarQube version 9.9.4 LTA and earlier Description: The issue concerns the potential exposure of encrypted values in cleartext as part of URL parameters in logs, such as SonarQube Access Logs and Proxy Logs...

ATEN International PE6208 安全漏洞

The ATEN International PE6208 is a power distribution unit from China-based ATEN Automation Technology ATEN International. A security vulnerability exists in the ATEN International PE6208 version 2.3.228, version 2.4.232, which originates from incorrect access control in the log management functi...

CVE-2024-29852

Veeam Backup Enterprise Manager (VBEM) is affected by CVE-2024-29852, where high-privilege users can read backup session logs. The issue is addressed in VBEM version 12.1.2.172 (bundled with Veeam Backup & Replication 12.1.2.172). VBEM is optional; environments without VBEM installed are not impa...