CVE-2023-31413

Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled...

Cross Site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

Cross site scripting

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

CVE-2023-25827 Cross-site Scripting in OpenTSDB

Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a...

OpenTSDB 跨站脚本漏洞

OpenTSDB is a suite of open source, scalable distributed time series databases. A security vulnerability exists in OpenTSDB versions 1.0.0 through 2.4.1, which stems from an insufficient validation of parameters reflected in error messages by a logging endpoint, and could potentially inject and...

GHSA-G35X-J6JJ-8G7J @mittwald/kubernetes's secret contents leaked via debug logging

Impact When debug logging is enabled via DEBUG environment variable, the Kubernetes client may log all response bodies into the debug log -- including sensitive data from Secret resources. When running in a Kubernetes cluster, this might expose sensitive information to users who are not authorise...

@mittwald/kubernetes's secret contents leaked via debug logging

Impact When debug logging is enabled via DEBUG environment variable, the Kubernetes client may log all response bodies into the debug log -- including sensitive data from Secret resources. When running in a Kubernetes cluster, this might expose sensitive information to users who are not authorise...

PT-2023-9265 · Elastic +1 · Filebeat +1

Name of the Vulnerable Software and Affected Versions: Filebeat versions through 7.17.9 and 8.6.2 Description: The issue is related to a flaw in the httpjson input of Filebeat, which allows the contents of the http request Authorization or Proxy-Authorization header to be leaked in the logs when...

PT-2023-33015 · Unknown · Kubernetes Client

Name of the Vulnerable Software and Affected Versions: Kubernetes client versions prior to 3.5.0 Description: The issue allows sensitive data from Secret resources to be logged into the debug log when debug logging is enabled via the DEBUG environment variable. This could expose sensitive...

Race Condition leading to logging errors

In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user. Fixed in 5.3.3. In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different...

GHSA-HJP3-5G2Q-7JWW Race Condition leading to logging errors

In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user. Fixed in 5.3.3. In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different...

Race Condition leading to logging errors

In certain setups with threaded web servers, Audited's use of Thread.current can incorrectly attributed audits to the wrong user. Fixed in 5.3.3. In March, @convisoappsec noticed that the library in question had a Race Condition problem, which caused logs to be registered at times with different...

CVE-2023-29471

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

PT-2023-22270 · Lightbend · Alpakka Kafka

Name of the Vulnerable Software and Affected Versions: Lightbend Alpakka Kafka versions prior to 5.0.0 Description: The issue allows log files to contain credentials if plain cleartext login is configured, as the configuration is logged as debug information. This occurs in the...

CVE-2023-29471

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

GHSA-MJV9-VP6W-3RC9 AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to...

AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending

The awssigv4::SigningParams struct had a derived Debug implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token in plaintext. When TRACE-level logging is enabled for an SDK, SigningParams is printed, thereby revealing those credentials to...

Moderate: Red Hat Security Advisory: Logging Subsystem 5.6.5 - Red Hat OpenShift security update

Logging Subsystem 5.6.5 - Red Hat OpenShift Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Referenc...