CVE-2023-27108

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allow...

Design/Logic Flaw

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allow...

Race Condition

Overview audited is a logging module for ORM models Affected versions of this package are vulnerable to Race Condition involving Thread.current which, in certain setups with threaded web servers, can log the wrong username in an audit log. Remediation Upgrade audited to version 5.3.3 or higher...

sensitive data exposure in cloud-init logs

...

FreeBSD : cloud-init -- sensitive data exposure in cloud-init logs (02562a78-e6b7-11ed-b0ce-b42e991fc52e)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 02562a78-e6b7-11ed-b0ce-b42e991fc52e advisory. - Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use th...

PT-2023-20958 · Kaios · Kaios

Name of the Vulnerable Software and Affected Versions: KaiOS version 3.0 Description: An issue was discovered in the pre-installed Communications application, which exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript...

KaiOS 安全漏洞

KaiOS is an application software. application for smart feature phones. A security vulnerability exists in KaiOS version 3.0, which stems from the ability to return a user's call logs without origin or privilege checking, which could allow an attacker to inject a JavaScript payload running in the...

CVE-2023-27108

An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allow...

CVE-2023-27108

CVE-2023-27108 (KaiOS 3.0) concerns the pre-installed Communications app, which exposes a Web Activity that returns the user’s call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app with no user interaction or consent, enabling exfi...

CVE-2023-2386

A vulnerability classified as problematic has been found in Netgear SRX5308 up to 4.3.5-3. Affected is an unknown function of the file scgi-bin/platform.cgi?page=firewalllogsemail.htm of the component Web Management Interface. The manipulation of the argument smtpServer.toAddr leads to cross site...

CVE-2023-2383

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. It has been classified as problematic. This affects an unknown part of the file scgi-bin/platform.cgi?page=firewalllogsemail.htm of the component Web Management Interface. The manipulation of the argument smtpServer.fromAddr leads to cro...

CVE-2023-2382

A vulnerability was found in Netgear SRX5308 up to 4.3.5-3 and classified as problematic. Affected by this issue is some unknown functionality of the file scgi-bin/platform.cgi?page=firewalllogsemail.htm of the component Web Management Interface. The manipulation of the argument...

VMware Aria Operations for Logs 8.10.2 RCE (VMSA-2023-0007)

The VMware Aria Operations for Logs formerly VMware vRealize Log Insight application running on the remote host is 8.10.2. It is, therefore, affected by a remote code execution vulnerability caused by insecure deserialization. An unauthenticated, malicious actor with network access to VMware Aria...

VMware Aria Operations for Logs 8.6.x / 8.8.x / 8.10 / 8.10.2 Command Injection (VMSA-2023-0007)

The VMware Aria Operations for Logs formerly VMware vRealize Log Insight application running on the remote host is affected by a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root. Note that...

GHSA-55VQ-XPJF-R2XC Lightbend Alpakka Kafka logs credentials on debug level

Lightbend Alpakka Kafka before 4.0.2 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

Design/Logic Flaw

Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials if plain cleartext login is configured. This occurs in akka.kafka.internal.KafkaConsumerActor...

CVE-2023-1786

A vulnerability was found in cloud-init. With this flaw, exposure of sensitive data is possible in world-readable cloud-init logs. This flaw allows an attacker to use this information to find hashed passwords and possibly escalate their privilege...

Oracle Linux 8 : cloud-init (ELSA-2023-12298)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-12298 advisory. 22.1-6.0.4.el87.2 - Fix log file permissions Orabug: 35302985 22.1-6.0.3.el87.2 - Fix CVE-2023-1786 Orabug: 35302985 Tenable has extracted the preceding...

Ubuntu: Security Advisory (USN-6042-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AZL-26342 CVE-2023-1786 affecting package cloud-init for versions less than 22.4-3

Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege...