395 matches found
CVE-2025-7203
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enable...
EUVD-2025-211117
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enable...
CVE-2025-7203
Multiple WSO2 products are vulnerable to sensitive information disclosure via the Management Console and product files. When the remote logging feature is enabled, the system fails to sufficiently protect or obscure credentials, exposing remote log server credentials , truststore passwords , and ...
CVE-2025-7203 Sensitive Information Disclosure via Management Console and Product Files in Multiple WSO2 Products Allows Retrieval of Credentials
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enable...
CVE-2025-29471
Stored XSS Vulnerability in Nagios Log Server Privilege Escalation to Admin ▶️ PoC Demo Date: 2025-04-02 Exploit Author: Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...
CVE-2025-44823
Authenticated API Key Exposure in Nagios Log Server 2024R1.3.1 ▶️ PoC Demo CVE ID: CVE-2025-44823 Date: 2025-04-02 Authors: Alex Tisdale, Seth Kraft Vendor Homepage: https://www.nagios.com/ Vendor Changelog: https://www.nagios.com/changelog/log-server Software Link:...
CVE-2025-34322_CVE-2025-34323_Nagios_Log_Server
CVE-2025-34322 and CVE-2025-34323 Nagios Log Server Proof of Concept exploits for CVE-2025-34322 and CVE-2025-34323 in Nagios Log Server, along with a combined script to return a shell as root. CVE-2025-34322 After auth, replace your session ID into these two curl commands. The first one set the...
Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting
Nagios-Log-Server-2.1.7-Persistent-Cross-Site-Scripting A stored cross-site scripting XSS in Nagios Log Server 2.1.7 can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page. Nagios Log Server 2.1.7 and older versions are affected...
Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts...
PT-2026-96718
Name of the Vulnerable Software and Affected Versions Check Point Security Management Server versions R81.10 through R82.20 Check Point Multi-Domain Security Management Server versions R81.10 through R82.20 Check Point Log Server versions R81.10 through R82.20 Check Point SmartEvent versions R81....
CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server
Symptoms - A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server. This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked. This...
PT-2026-93729
Name of the Vulnerable Software and Affected Versions Check Point Security Management Server affected versions not specified Check Point Multi-Domain Security Management affected versions not specified Check Point Log Server affected versions not specified Description A stack-based buffer overflo...
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
BIT-AIRFLOW-2026-45426 Apache Airflow: Log server JWT authorization bypass via Python lstrip() character stripping allows cross-Dag log access
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
PYSEC-0000-CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
PYSEC-2026-174
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
PYSEC-2026-174
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's str.lstrip to the requested path segment when verifying the JWT's sub...
CVE-2026-45426
Exploitation requires the attacker to already be an authenticated Airflow worker holding a valid Log-server JWT issued for at least one Dag. Apache Airflow's Log server authorized JWT tokens against Dag IDs by applying Python's "str.lstrip" to the requested path segment when verifying the JWT's...
CVE-2026-45426
Apache Airflow's Log server contains an authorization bypass vulnerability caused by the improper use of Python's str.lstrip() when verifying the sub claim of a Log-server JWT. Because str.lstrip() removes any characters from a provided set rather than a specific prefix, an authenticated worker w...