PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS, which originates from a lack of data validation filtering of user-supplied data and output in...

Log Injection

org.apache.sling:org.apache.sling.api and org.apache.sling:org.apache.sling.commons.log is vulnerable to log injection. A remote attacker with privileges to forge logs, is able to inject fake logs and potentially corrupt log files, causing unintended behavior in the the system...

Log Injection in Apache Sling Commons Log and Apache Sling API

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

PT-2022-20525 · Weave · Weave Gitops

Name of the Vulnerable Software and Affected Versions: Weave GitOps versions prior to v0.8.1-rc.6 Description: A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters,...

IBM QRadar WinCollect Agent Information Disclosure Vulnerability

BM QRadar WinCollect Agent is an agent program for collecting and sending Windows event logs from IBM, U.S. An information disclosure vulnerability exists in BM QRadar WinCollect Agent, which stems from a lack of best practices and can be exploited by attackers to gain access to sensitive...

CVE-2022-32549

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

CVE-2022-32549 log injection in Sling logging

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

CVE-2022-32549 log injection in Sling logging

Apache Sling Commons Log = 5.4.0 and Apache Sling API = 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover tracks by injecting fake logs and potentially corrupt log files...

CVE-2022-20651 Cisco Adaptive Security Device Manager Information Disclosure Vulnerability

A vulnerability in the logging component of Cisco Adaptive Security Device Manager ASDM could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shared workstation environment for this issue to be exploited...

IBM QRadar WinCollect Agent 安全漏洞

BM QRadar WinCollect Agent is an agent program for collecting and sending Windows event logs from IBM, U.S. An information disclosure vulnerability exists in BM QRadar WinCollect Agent, which stems from a lack of best practices and can be exploited by attackers to gain access to sensitive...

Malicious code in hypercore-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41ad55ac1ce974e546de492e35db0b27f3f3e4e28404c6bdf3311211a2c58be3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3738 Malicious code in hypercore-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41ad55ac1ce974e546de492e35db0b27f3f3e4e28404c6bdf3311211a2c58be3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross site request forgery (csrf)

The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack...

How much does access to corporate infrastructure cost?

Division of labor Money has been and remains the main motivator for cybercriminals. The most widespread techniques of monetizing cyberattacks include selling stolen databases, extortion using ransomware and carding. However, there is demand on the dark web not only for data obtained through an...

CVE-2022-32254

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valuable guidance to an attacker...

Unpatched Travis CI API Bug Exposes Thousands of Secret User Access Tokens

An unpatched security issue in the Travis CI API has left tens of thousands of developers' user tokens exposed to potential attacks, effectively allowing threat actors to breach cloud infrastructures, make unauthorized code changes, and initiate supply chain attacks. "More than 770 million logs o...

Samsung Find My Mobile FmmExtraOperation Information Disclosure Vulnerability

Samsung Find My Mobile is an application to find a cell phone by the South Korean company Samsung Samsung. An information disclosure vulnerability exists in Samsung Find My Mobile prior to version 7.2.24.12, FmmExtraOperation. A local attacker with log access could exploit the vulnerability to...

Samsung Find My Mobile SimChangeAlertManger Information Disclosure Vulnerability

Samsung Find My Mobile is an application to find a cell phone by the South Korean company Samsung Samsung. An information disclosure vulnerability exists in SimChangeAlertManger, a version prior to Samsung Find My Mobile 7.2.24.12. A local attacker with log access could exploit the vulnerability ...

PT-2022-20485 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 7.6.57 ELTS TYPO3 versions prior to 8.7.47 ELTS TYPO3 versions prior to 9.5.34 ELTS TYPO3 versions prior to 10.4.29 TYPO3 versions prior to 11.5.11 Description: System internal credentials or keys, such as database...

CVE-2022-1412 Log WP_Mail <= 0.1 - Email Logs Publicly Accessible

The Log WPMail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords...