GHSA-5FP8-C45M-256P Improper Encoding or Escaping of Output in Apache Superset

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...

Improper Encoding or Escaping of Output in Apache Superset

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...

SaltStack Salt Cleartext Storage of Sensitive Information via cmdmod

An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level...

GHSA-RWH3-5G7V-3C5M Password written to the build log by Jenkins SQLPlus Script Runner Plugin

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier prints the sqlplus command invocation to the build logs. This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission. Jenkins SQLPlus Script Runner...

Password written to the build log by Jenkins SQLPlus Script Runner Plugin

Jenkins SQLPlus Script Runner Plugin 2.0.12 and earlier prints the sqlplus command invocation to the build logs. This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission. Jenkins SQLPlus Script Runner...

GHSA-W4Q7-F34X-VPGC FreeIPA logs passwords embedded in commands in calls using batch

A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with...

GHSA-JMRX-5G74-6V2F Kubernetes client-go library logs may disclose credentials to unauthorized users

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

Kubernetes client-go library logs may disclose credentials to unauthorized users

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

Maven Integration Plugin did not mask sensitive values in module build logs

Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log...

Insertion of Sensitive Information into Log File

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

Insertion of Sensitive Information into Log File

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

The vulnerability of the “Red Database” database management system lies in the improper recording of security events, allowing attackers to conceal the source or nature of an attack.

The vulnerability of the “Red Database” database management system is related to incorrect recording of security events when attempting to create or open logs for recording registered events in the journal. Exploiting this vulnerability can allow an attacker to complicate the analysis of audit...

The vulnerability of the “Red Database” database management system stems from deficiencies in audit logs, allowing attackers to conceal the source or nature of their attacks.

The vulnerability of the “Red Database” database management system is related to deficiencies in audit log management. Exploiting this vulnerability could allow a malicious actor to conceal the source or nature of an attack...

Fslogix Roaming Profile Failing To Load On Windows 10 AWS Hosted VDA

Fslogix roaming profile failing to load on windows 10 AWS hosted VDA Issue was reprodubile in RDP session as well The below errors were logged in the event logs: Operation: FSLogixLogonPROFILE, SessionId: 3, ErrorCode: 1168, Detail: Logon failed, Please check logs and tracelogging and verify that...

CVE-2022-28660

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode...

CVE-2022-28660

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode...

Authentication flaw

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode...

CVE-2022-28660

Grafana Enterprise Logs 1.1.x–1.3.x (before 1.4.0) contain an authentication bypass in the querier component when the X-Scope-OrgID header is used, affecting -auth.type=enterprise in microservices mode. The issue is fixed in 1.4.0 (and later); affected versions include 1.1.x, 1.2.x, and 1.3.x. Re...

CVE-2022-28660

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode...

CVE-2022-28660

The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode...