CVE-2024-52973

CVE-2024-52973 affects Kibana (Observability-Logs) where an allocation of resources without limits or throttling can cause a crash via a crafted request to /api/log_entries/summary. The issue is exploitable by users with read access to Observability-Logs, with CVSSv3.1 base score 6.5 (Network att...

CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/logentries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana...

CVE-2024-52973 Kibana allocation of resources without limits or throttling leads to crash

An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to /api/logentries/summary. This can be carried out by users with read access to the Observability-Logs feature in Kibana...

Information Disclosure

typo3/cms-install is vulnerable to Information Disclosure. The vulnerability is due to an incorrect password hashing mechanism, which causes the install tool password to be logged in plaintext, allowing an attacker to potentially gain access to the password if they can access the logs or system...

CVE-2024-45091

IBM UrbanCode Deploy UCD 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs...

PT-2025-5363 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.55417 Description: The issue is related to the exposure of permanent tokens in logs, potentially allowing an attacker to obtain encrypted user credentials. This could be exploited through the...

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tool lies in its improper handling of output data from registration logs, allowing a hacker to execute arbitrary commands.

The vulnerability of IBM Concert Software’s artificial intelligence-based automation tool is related to incorrect processing of output data for registration logs. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2025-2684 · Ibm · Ibm Urbancode Deploy

Name of the Vulnerable Software and Affected Versions: IBM UrbanCode Deploy UCD versions 7.0 through 7.0.5.24 IBM UrbanCode Deploy UCD versions 7.1 through 7.1.2.10 IBM UrbanCode Deploy UCD versions 7.2 through 7.2.3.13 Description: The issue concerns the storage of potentially sensitive...

PT-2025-2949 · Elastic · Kibana

Name of the Vulnerable Software and Affected Versions: Kibana affected versions not specified Description: An allocation of resources without limits or throttling in Kibana can lead to a crash caused by a specially crafted request to "/api/log entries/summary". This can be carried out by users wi...

CVE-2024-57929

In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dmarraycursorend When dmbmreadlock fails due to locking or checksum errors, it releases the faulty block implicitly while leaving an invalid output pointer behind. The caller ...

CVE-2025-23922

creationtimestamp| type| source ---|---|--- 2025-01-16 21:20:13+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfv7i2p3jk2n 2025-01-16 21:48:54+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/113840235016825074 2025-01-16 21:49:24+00:00| seen|...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the display parameter in the device editing interface. PoC " This is triggered by hoveri...

CVE-2024-12226

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions...

CVE-2024-12226

In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieved in Version 1 and the fix was applied to both versions...

CVE-2024-9042

A flaw was found in Kubernetes Windows nodes. This vulnerability allows a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

Command Injection affecting Windows nodes via nodes/*/logs/query API

Hello Kubernetes Community, A security vulnerability has been discovered in Kubernetes windows nodes that could allow a user with the ability to query a node's '/logs' endpoint to execute arbitrary commands on the host. This issue has been rated Medium with a CVSS v3.1 score of 5.9...

CVE-2025-0482

creationtimestamp| type| source ---|---|--- 2025-01-15 19:36:14+00:00| seen| https://infosec.exchange/users/cve/statuses/113834051097885100 2025-01-15 19:55:16+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/1846 2025-01-15 20:16:10+00:00| seen|...

DEBIAN-CVE-2024-11029

A flaw was found in the FreeIPA API audit, where it sends the whole FreeIPA command line to journalctl. As a consequence, during the FreeIPA installation process, it inadvertently leaks the administrative user credentials, including the administrator password, to the journal database. In the...

CISA Releases Microsoft Expanded Cloud Logs Implementation Playbook

Today, CISA released the Microsoft Expanded Cloud Logs Implementation Playbook to help organizations get the most out of Microsoft’s newly introduced logs in Microsoft Purview Audit Standard. This step-by-step guide enables technical personnel to better detect and defend against advanced intrusio...

tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...