PT-2023-11876 · Cartflows · Woocommerce Checkout & Funnel Builder By Cartflows

Name of the Vulnerable Software and Affected Versions: WooCommerce Checkout & Funnel Builder by CartFlows plugin for WordPress versions up to, and including, 1.5.15 Description: The issue is due to missing or incorrect nonce validation on the export json, import json, and status logs file...

OESA-2023-1297 cloud-init security update

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance. Security Fixes: Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their...

OESA-2023-1290 cloud-init security update

Cloud-init is the defacto multi-distribution package that handles early initialization of a cloud instance. Security Fixes: Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed...

Fedora 38 : cloud-init (2023-c17dde4052)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-c17dde4052 advisory. Update to 23.1.2 and fix CVE-2023-1786 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

DEBIAN-CVE-2023-1786

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege...

PT-2023-17244 · Unknown +10 · Cloud-Init +10

Name of the Vulnerable Software and Affected Versions: cloud-init versions prior to 23.1.2 Description: The issue allows sensitive data to be exposed in logs, which an attacker could use to find hashed passwords and possibly escalate their privilege. Recommendations: For versions prior to 23.1.2,...

CVE-2023-23591

The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1...

Hitachi Vantara Pentaho Business Analytics Server 日志信息泄露漏洞

Hitachi Vantara Pentaho Business Analytics Server is a modern data blending, integration, and business analytics platform from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Business Analytics Server that originates from exposing sensitive data to system...

SUSE CVE-2015-9543

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is...

SUSE CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

PT-2022-17086 · Hitachi Energy · Pcm600

Name of the Vulnerable Software and Affected Versions: Hitachi Energy’s PCM600 product affected versions not specified Description: A vulnerability exists in the Intelligent Electronic Device IED Connectivity Package ConnPack credential storage function, where IEDs credentials are stored in a...

Dell PowerPath Management Appliance 安全漏洞

Dell PowerPath Management Appliance is a PowerPath host management application from Dell USA that offers two models: a virtual machine-based appliance and a Docker containerized appliance. The Dell PowerPath Management Appliance is vulnerable to a sensitive information disclosure vulnerability th...

PYSEC-2022-42976

A stored cross-site scripting XSS vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI...

Ansible 安全漏洞

Red Hat Ansible is a computer system configuration manager from Red Hat, an American company. The product can be used to distribute, manage, and organize computer systems. A security vulnerability exists in Ansible. An attacker exploited the vulnerability to cause password leakage in logs...

Dependency-Track 安全漏洞

Dependency-Track is an intelligent supply chain component analysis platform for identifying third-party component risks. A security vulnerability exists in Dependency-Track versions prior to 4.6.0, which stems from the fact that executing an API request with a valid API key with insufficient...

Apple macOS 安全漏洞

Apple macOS is a specialized operating system developed by Apple Inc. for Mac computers. Apple macOS suffers from a security vulnerability that stems from the fact that a user with physical access to an iOS device may be able to read past diagnostic logs. The following products and versions are...

CVE-2022-20830

A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage could allow an unauthenticated, remote attacker to access the GUI of Cisco SD-AVC without authentication. This vulnerability exists because the GUI is accessible on...

DEBIAN-CVE-2022-39289

ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. Users are advised yo upgrade as soon as...

PT-2022-6014 · Cisco · Cisco Sd-Avc +1

Name of the Vulnerable Software and Affected Versions: Cisco Software-Defined Application Visibility and Control SD-AVC on Cisco vManage affected versions not specified Description: A vulnerability in the authentication mechanism of Cisco SD-AVC on Cisco vManage could allow an unauthenticated,...

CVE-2022-36877

Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attackers to access device identification via log...