Yelp: Object Level access control leads to reading user's full requests, sessions, and error messages

The summary is as follows: A vulnerability was discovered in the Yelp internal administration tool called "Tailored Mail" hosted on the subdomain https://proze.yelp.com/. The vulnerability allowed unauthenticated attackers to read the internal admin's full HTTP requests, sessions, and other...

Nextcloud: admin_audit does not log actions on files in a group folder

The adminaudit app in Nextcloud versions prior to 24.0.4 did not log actions on files in a group folder...

MAL-2024-11769 Malicious code in dhp-logging-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware def2cfdcf7555dce8bc6545670a20f1748d6588683a817bc7d922f42c8e9cd43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dhp-logging-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware def2cfdcf7555dce8bc6545670a20f1748d6588683a817bc7d922f42c8e9cd43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Log Injection

org.apache.nifi, nifi is vulnerable to Log Injection. The vulnerability is due to the optional debug logging feature, which allows an authorized administrator to enable detailed logging of Parameter Context values during flow synchronization...

PcVue 安全漏洞

PcVue is a reliable, secure, and powerful operational software platform from PcVue, Inc. dedicated to monitoring and controlling applications in markets such as building and campus management. A security vulnerability exists in PcVue that stems from user credentials login and password being...

CVE-2024-55578

Zammad before 6.4.1 places sensitive data such as authmicrosoftoffice365credentials and applicationsecret in log files...

Synology Router Manager 安全漏洞

Synology Router Manager SRM is a software used to configure and manage Synology routers from China-based Synology. A security vulnerability exists in Synology Router Manager versions prior to 1.3.1-9346-10, which stems from improper input neutralization in the DDNS logging feature, which is...

Malicious code in bbb-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 521983fba00c501c41ccbb9e7737eed8be5cff75f427bd2db33daacfdc645e02 The OpenSSF Package Analysis project identified 'bbb-logging' @ 1.0.6 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11239 Malicious code in bbb-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 521983fba00c501c41ccbb9e7737eed8be5cff75f427bd2db33daacfdc645e02 The OpenSSF Package Analysis project identified 'bbb-logging' @ 1.0.6 npm as malicious. It is considered malicious because: - The package...

Malicious code in yelp-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ff40f995641f74640b48eeefb3717de25988026d50ca8f472fe4b69d7a91ca7 The OpenSSF Package Analysis project identified 'yelp-logging' @ 1.0.39 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11233 Malicious code in yelp-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ff40f995641f74640b48eeefb3717de25988026d50ca8f472fe4b69d7a91ca7 The OpenSSF Package Analysis project identified 'yelp-logging' @ 1.0.39 npm as malicious. It is considered malicious because: - The package...

CVE-2024-12003

creationtimestamp| type| source ---|---|--- 2024-12-06 09:36:21+00:00| seen| https://infosec.exchange/users/cve/statuses/113605199823333797 2024-12-06 10:35:57+00:00| seen| https://t.me/cvedetector/12184...

openSUSE Security Advisory (SUSE-SU-2024:4194-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for python-python-multipart

This update for python-python-multipart fixes the following issues: CVE-2024-53981: excessive logging for certain inputs when parsing form data. bsc1234115 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2024:4194-1 Security update for python-python-multipart

This update for python-python-multipart fixes the following issues: - CVE-2024-53981: excessive logging for certain inputs when parsing form data. bsc1234115...

X11 Keylogger

This module binds to an open X11 host to log keystrokes. This is a fairly close copy of the old xspy c program which has been on Kali for a long time. The module works by connecting to the X11 session, creating a background window, binding a keyboard to it and creating a notification alert when a...

ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

Exploit for Uncontrolled Resource Consumption in Ietf Http

CVE-2023-44487 - HTTP/2 Rapid Reset Exploit PoC --- Desc...

Allocation of Resources Without Limits or Throttling

Overview python-multipart is an A streaming multipart parser for Python Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the multipart/form-data, when line breaks: CR \r or LF \n in front of the first boundary and any tailing bytes...