Sensitive Information Into Log File

github.com/goreleaser/goreleaser is vulnerable to Information Exposure. The vulnerability is due to a flaw in the handling of debug logs WithField"env", c.Env which is used to log environment variables., The goreleaser release --debug command includes sensitive information such as secrets or...

facileManager SQL注入漏洞

facileManager is a suite of modular Web applications from facileManager, Inc. facileManager suffers from an SQL injection vulnerability that originates from an unsafe call to the extract function in admin-logs.php. An attacker can use this vulnerability to view, add, modify, or delete information...

CVE-2024-23840

A flaw was found in GoReleaser. This package log shows secret values that are supposed to be hidden when using --debug. Mitigation No mitigation is yet available for this vulnerability despite having control of the --debug and where the logs are located...

`goreleaser release --debug` shows secrets

Summary Hello 👋 goreleaser release --debug log shows secret values used in the in the custom publisher. How to reproduce the issue: - Define a custom publisher as the one below. Make sure to provide a custom script to the cmd field and to provide a secret to env .goreleaser.yml publishers: - name...

CVE-2023-46231

In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on...

PT-2024-1642 · Splunk · Splunk Add-On Builder

Name of the Vulnerable Software and Affected Versions: Splunk Add-on Builder versions prior to 4.1.4 Description: The issue is related to improper handling of log output, allowing a remote attacker to write arbitrary information to internal log files. This can lead to the exposure of sensitive...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

GoReleaser Log Information Disclosure Vulnerability

GoReleaser is a binary delivery tool for GO applications. GoReleaser suffers from a log message disclosure vulnerability that stems from displaying secret values in logs...

Splunk Security Breach

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index, and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines, and cloud. A...

CVE-2024-0987

A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The...

Design/Logic Flaw

A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The...

CVE-2024-0987

CVE-2024-0987 affects Sichuan Yougou Technology KuERP up to version 1.0.4. The vulnerability lies in an unknown function under the /runtime/log path, causing improper output neutralization for logs. The exploit has been disclosed publicly. Connected sources confirm the affected product and compon...

OTRS Log Information Disclosure Vulnerability

OTRS is an application from OTRS Germany. A service management software. A security vulnerability exists in OTRS that stems from the insertion of debugging information into a log file during the construction of a resilient search index allowing sensitive information to be read from it...

CVE-2021-43584

DOM-based Cross Site Scripting XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent NCPA before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log...

Code injection

Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious...

CVE-2024-22229

Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious...

CVE-2024-22229

Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker. An attacker could exploit this vulnerability to forge log entries, create false alarms, and inject malicious content into logs that compromise logs integrity. A malicious...

CVE-2021-43584

DOM-based Cross Site Scripting XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent NCPA before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log...

PRTG Authenticated Remote Code Execution Exploit

class MetasploitModule 'PRTG CVE-2023-32781 Authenticated RCE', 'Description' = %q Authenticated RCE in Paessler PRTG , 'License' = MSFLICENSE, 'Author' = 'Kevin Joensen ', 'References' = 'URL', 'https://baldur.dk/blog/prtg-rce.html', 'CVE', '2023-32781' , 'DisclosureDate' = '2023-08-09',...

PT-2024-14253

Name of the Vulnerable Software and Affected Versions Airflow versions 5.2.0 through 6.x Airflow versions 2.3.0 through 2.6.0 Description The Airflow worker serializes a Kubernetes configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption wh...