PT-2024-32406 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p22 Checkmk versions prior to 2.2.0p37 Checkmk versions prior to 2.1.0p50 EOL Description: The issue concerns the insertion of sensitive information into log files in Checkmk, causing remote site secrets to be...

CVE-2024-35371

Ant-Media-Server v2.8.2 is affected by Improper Output Neutralization for Logs due to insufficient input sanitization in the logging mechanism. User-controllable data can be included in log entries without restrictions, potentially exposing sensitive information. The CVE-2024-35371 entry, with a ...

Sensitive Data Exposure

apacheairflow is vulnerable to Sensitive Data Exposure. The vulnerability is due to sensitive variable values being logged unencrypted in audit logs when set via the CLI, which allows an attacker with audit log access to view those sensitive values...

SUSE CVE-2024-52337

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-53859

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

AZL-53477 CVE-2024-53858 affecting package gh for versions less than 2.62.0-5

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts

Summary A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. Details This vulnerability stems from several gh commands used to clone a repository with...

`auth.TokenForHost` violates GitHub host security boundary when sourcing authentication token within a codespace

Summary A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. Details go-gh sources authentication tokens from different environment variables depending on the host involved: - GITHUBTOKEN...

CVE-2024-53858 Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53858

The gh cli is GitHub’s official command line tool. A security vulnerability has been identified in the GitHub CLI that could leak authentication tokens when cloning repositories containing git submodules hosted outside of GitHub.com and ghe.com. This vulnerability stems from several gh commands...

CVE-2024-53859 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

DEBIAN-CVE-2024-52337

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-52337 Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

CVE-2024-9929

A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...

CVE-2024-9929

A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...

CVE-2024-9929

A vulnerability exists in NSD570 that allows any authenticated user to access all device logs disclosing login information with timestamps...

CVE-2024-9929

CVE-2024-9929 affects Hitachi Energy NSD570. The connected sources describe a vulnerability where any authenticated user can access all device logs, exposing login timestamps. Impact is limited to information disclosure of logs; no exploitation details or CVSS-specific vectors are provided beyond...

PT-2024-39944 · Nsd570 · Nsd570

Name of the Vulnerable Software and Affected Versions: NSD570 affected versions not specified Description: A security issue exists that allows any authenticated user to access all device logs, revealing login information with timestamps. Recommendations: At the moment, there is no information abo...

PT-2024-35702 · Unknown · Sigstore-Java

Name of the Vulnerable Software and Affected Versions: sigstore-java versions prior to v1.1.0 Description: The issue is related to insufficient verification in sigstore-java for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log...