Lucene search
+L

28019 matches found

Vulnrichment
Vulnrichment
•added 2026/09/16 9:28 a.m.•10 views

CVE-2026-84501 Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

5.9AI score0.00742EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/16 9:28 a.m.•17 views

CVE-2026-84501

Apache ZooKeeper is vulnerable to operational log forgery via newline injection in EnsembleAuthenticationProvider.handleAuthentication() . An unauthenticated attacker sends a crafted add_auth("ensemble", ...) request containing newline characters; when the ensemble name doesn't match, the raw uns...

5.8AI score0.00742EPSS
SaveExploits0References2Affected Software1
Debian CVE
Debian CVE
•added 2026/09/16 9:28 a.m.•9 views

CVE-2026-84501

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted addauth"ensemble", ... request containing newline characters \n. When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

5.9AI score0.00742EPSS
SaveExploits0
Debian CVE
Debian CVE
•added 2026/09/16 9:27 a.m.•9 views

CVE-2026-84439

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

5.9AI score0.00742EPSS
SaveExploits0
CVE
CVE
•added 2026/09/16 9:27 a.m.•22 views

CVE-2026-84439

Apache ZooKeeper (versions 3.8.0–3.8.6 and 3.9.0–3.9.5) contains an audit log injection vulnerability. When audit logging is enabled (zookeeper.audit.enable=true), the server serializes attacker-controlled input—either a digest-authentication username or a setACL ACL id—into the tab-separated key...

5.9AI score0.00742EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2026/09/16 9:27 a.m.•30 views

CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

0.00742EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/16 9:27 a.m.•6 views

EUVD-2026-80333

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

5.9AI score0.00742EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/16 9:27 a.m.•6 views

CVE-2026-84439 Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources

When audit logging is enabled zookeeper.audit.enable=true, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters \t embedded in the username. Because the audit log uses tab-separated key=value forma...

6AI score0.00742EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/16 12:00 a.m.•21 views

PT-2026-93339

An unauthenticated remote attacker can exploit an authentication bypass in the account log function to log in as an admin, even when accounts are properly configured...

9.8CVSS5.8AI score0.01017EPSS
SaveExploits0References4
CheckPoint Security
CheckPoint Security
•added 2026/09/16 12:00 a.m.•29 views

CVE-2026-91843 - Stack overflow in login process to the Security Management and Log Servers

Symptoms - Issue: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. This issue received the ID CVE-2026-91843 and a CVSS score of 9.8. Affected Products: Security Management Server, Multi-Domain Security Management...

9.8CVSS8.6AI score0.00519EPSS
SaveExploits0
NVD
NVD
•added 2026/09/15 9:16 p.m.•9 views

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

6.5CVSS0.00371EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
•added 2026/09/15 8:45 p.m.•8 views

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in log4j-core Vulnerability Details CVEID:CVE-2026-34480 DESCRIPTION: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.htmlXmlLayout , in versions up to and including 2.25.3, fails t...

7.5CVSS7AI score0.01187EPSS
SaveExploits0Affected Software1
Cvelist
Cvelist
•added 2026/09/15 8:14 p.m.•32 views

CVE-2026-92237

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

0.00371EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/15 7:17 p.m.•10 views

CVE-2026-73465

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already...

6.3CVSS0.00132EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/15 7:17 p.m.•7 views

CVE-2026-73466

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

6.3CVSS0.00132EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/15 6:41 p.m.•8 views

EUVD-2026-79024

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

6.3CVSS5.8AI score0.00132EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/15 6:41 p.m.•29 views

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

6.3CVSS0.00132EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/15 6:41 p.m.•28 views

CVE-2026-73466

CVE-2026-73466 affects Arista EOS , where plaintext user passwords may be written to log files (/var/log/agents/Aaa-*) under CWE-532 (Insertion of Sensitive Information into Log File). The precondition is that PyServer trace level 4 on agent Aaa is explicitly enabled via a non-standard debugging ...

6.3CVSS5.8AI score0.00132EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/15 6:41 p.m.•8 views

CVE-2026-73466 On affected platforms running Arista EOS, under certain circumstances plaintext user passwords

On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess...

6.3CVSS5.8AI score0.00132EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/15 6:36 p.m.•24 views

CVE-2026-73465

CVE-2026-73465 is a CWE-532 (Insertion of Sensitive Information into Log File) vulnerability in Arista EOS . When MgmtSecuritySslCertKey trace levels 0, 3, and/or 4 are enabled on the ConfigAgent agent, plaintext RSA and EC private keys may be written to /var/log/agents/ConfigAgent-* log files. E...

6.3CVSS5.8AI score0.00132EPSS
SaveExploits0References1
Rows per page
Query Builder