GHSA-F54Q-J679-P9HH copyparty vulnerable to reflected cross-site scripting via k304 parameter

Summary The application contains a reflected cross-site scripting via URL-parameter ?k304=... and ?setck=... Details A reflected cross-site scripting XSS vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking user...

VMware Tanzu Application Service for VMs and Isolation Segment updates address information disclosure vulnerability (CVE-2023-20891)

3. VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability CVE-2023-20891 The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform...

Dell EMC PowerStore 日志信息泄露漏洞

Dell EMC PowerStore is a storage device from Dell USA. A log information disclosure vulnerability exists in Dell EMC PowerStore versions prior to 3.5.0.1, which originates from the insertion of sensitive information into a log file, and can be exploited by a malicious, high-privileged user to cau...

PT-2023-33011 · Copyparty · Copyparty

Name of the Vulnerable Software and Affected Versions: copyparty affected versions not specified Description: A reflected cross-site scripting vulnerability exists in the web interface of the application, allowing an attacker to execute malicious javascript code by tricking users into accessing a...

CVE-2023-34625

ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mechanism via Bluetooth Low Energy BLE is vulnerable to replay attacks. A malicious user is able to intercept BLE requests and replicate them to open the lock at any time...

Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats

Microsoft on Wednesday announced that it's expanding cloud logging capabilities to help organizations investigate cybersecurity incidents and gain more visibility after facing criticism in the wake of a recent espionage attack campaign aimed at its email infrastructure. The tech giant said it's...

PimpMyLog 1.7.14 Improper Access Control

Exploit Title: PimpMyLog v1.7.14 - Improper access control Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from...

Dell Wyse ThinOS 日志信息泄露漏洞

DELL Wyse ThinOS is a lightweight operating system designed for thin client devices, focused on providing a secure and efficient virtual desktop access experience. An information disclosure vulnerability exists in DELL Wyse ThinOS, which can be exploited by an attacker to read sensitive informati...

CVE-2023-26023

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...

CVE-2023-26026

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...

Code injection

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...

CVE-2023-26026 IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...

CVE-2023-26026

CVE-2023-26026 affects IBM Planning Analytics Cartridge for IBM Cloud Pak for Data 4.0. The vulnerability is an information disclosure via logs, caused by exposing sensitive data through log files. CNVD notes an related encryption issue tied to an insecure CouchDB password policy, enabling data c...

CVE-2023-26023 IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure

Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896...

PT-2023-20432 · Ibm · Planning Analytics Cartridge For Cloud Pak For Data

Name of the Vulnerable Software and Affected Versions: Planning Analytics Cartridge for Cloud Pak for Data version 4.0 Description: The issue exposes sensitive information in logs, which could allow an attacker to exploit it and conduct further attacks. Recommendations: For Planning Analytics...

IBM Planning Analytics 日志信息泄露漏洞

IBM Planning Analytics is a suite of business planning analytics solutions from International Business Machines IBM. The solution supports automated execution of processes such as business planning, budgeting, and analysis. A security vulnerability exists in Planning Analytics Cartridge for Cloud...

PimpMyLog v1.7.14 - Improper access control

Exploit Title: PimpMyLog v1.7.14 - Improper access control Date: 2023-07-10 Exploit Author: thoughtfault Vendor Homepage: https://www.pimpmylog.com/ Software Link: https://github.com/potsky/PimpMyLog Version: 1.5.2-1.7.14 Tested on: Ubuntu 22.04 CVE : N/A Description: PimpMyLog suffers from...

Information Disclosure

github.com/weaveworks/tf-controller is vulnerable to Information Disclosure. A flaw in Weave GitOps Terraform Runners tf-runner allows an authenticated remote attacker to acquire user information in pod logs due to accidentally displaying sensitive data by the victim. The functions tfexec.ShowPla...

WordPress Database Table Overview and Logs Plugin < 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Database Table Overview and Logs Type Plugin Vulnerable versions 1.1.0 Fixed in 1.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 43825b47431f Credits Rafie Muhammad...

EulerOS 2.0 SP10 : cloud-init (EulerOS-SA-2023-2349)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could...