9452 matches found
PYSEC-2021-435
Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs...
CVE-2021-42250
CVE-2021-42250 affects Apache Superset. The issue is improper output neutralization in a specific HTTP endpoint, allowing an authenticated user to forge log entries or inject malicious content into logs. Connected sources (NVD, OSV, GHSA, CNVD, OSV mirrors) confirm the vulnerability in Apache Sup...
Unspecified Vulnerability in IBM Spectrum Scale
IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...
CVE-2021-38882
IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records before expiration time. IBM X-Force ID: 209164...
Security Bulletin: IBM MQ Java/JMS clients can inadvertently display cleartext credentials via diagnostic logs (CVE-2021-38949)
Summary An issue was idenitifed in IBM MQ Java and JMS clients where they could display clear text credentials in diagnostics log files automatically generated during system crashes. Vulnerability Details CVEID: CVE-2021-38949 DESCRIPTION: IBM MQ stores user credentials in plain clear text which...
IBM Spectrum Scale 安全漏洞
IBM Spectrum Scale is a scalable data and file management solution from IBM USA based on IBM GPFS, an enterprise file management system optimized for petabyte-scale storage management. The product supports helping clients reduce storage costs while improving security and management efficiency in...
Huawei EulerOS: Security Advisory for sssd (EulerOS-SA-2021-2675)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4
The first 3 installments of our series on Rapid7's hands-on exercise from the IoT Village at this year's DefCon covered how to set up a UART header, how to determine UART status and baud rate, and how to log into single-user mode on the device. In this final post, we'll discuss how to gain full...
Evernote: [34.96.80.155] Server Logs Disclosure lead to Information Leakage
Summary: In this case server log is available for any in /server-status Steps To Reproduce: 1. Go to https://34.96.80.155/server-status/ and follow attack scenario's Attack Scenario's: Serg.io 1. User go to server and enter sensitive info that can be logged example : http://host/login?privatekey=...
CVE-2020-10052
A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V2.12. The affected application writes sensitive data, such as usernames and passwords in log files. A local attacker with access to the log files could use this information to launch further attacks...
Cross-Site Request Forgery (CSRF) in kevinpapst/kimai2
Description cross site request forgery vulnerability is present in delete functionality of doctor feature. Proof of Concept history.pushState'', '', '/' document.forms0.submit; Impact This vulnerability is capable of delete the existing logs...
CVE-2021-24767
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack...
CVE-2021-24695
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...
CVE-2021-24767
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack...
CVE-2021-24695
The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...
Cross site request forgery (csrf)
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack...
CVE-2021-24767
The CVE-2021-24767 entry affects the WordPress plugin “Redirect 404 Error Page to Homepage or Custom Page with Logs” (versions prior to 1.7.9). The root cause is a missing CSRF check when deleting logs, enabling a CSRF attacker to cause an authenticated admin to delete logs. Reported impact align...
CVE-2021-24766 404 to 301 < 3.0.9 - Logs Deletion via CSRF
The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin delete all of them via a CSRF attack...
CVE-2021-24695
Summary: The Simple Download Monitor WordPress plugin (before 3.9.6) stores logs in a predictable location and lacks authentication/authorization, allowing unauthenticated users to download and read logs that contain sensitive information (IP addresses, usernames). What’s affected: WordPress plug...
Rocket.Chat: Unintended information disclosure in the Hubot Log files
Dear Rocket.Chat Team While inspecting our logs I noticed, that the OAuth Tokens are leaked in plaintext in the logs. I wanted to draw your attention to this, as this is a security vulnerability. See the attached Screenshot for a redacted log excerpt. In my opinion, the best approach here would b...