9425 matches found
Kubernetes: CVE-2019-11250 remains in effect.
Report Submission Form Summary: "CVE-2019-11250: TOB-K8S-001: Bearer tokens are revealed in logs" remains in effect. Kubernetes Version: Effects at least all versions since 1.4. - This was determined with some git archaeology. This was determined by following the code snippet from it's current...
CVE-2020-17364
USVN aka User-friendly SVN before 1.0.9 allows XSS via SVN logs...
Design/Logic Flaw
USVN aka User-friendly SVN before 1.0.9 allows XSS via SVN logs...
CVE-2020-17364
CVE-2020-17364 affects USVN (User-friendly SVN) prior to 1.0.9. The issue is an XSS vulnerability that can be triggered via SVN logs, with CVSS v3.1 base score 6.1 (NETWORK, LOW attack complexity, NONE privileges, UI REQUIRED, scope CHANGED; confidentiality/integrity impact LOW, availability NONE...
CVE-2020-17364
USVN aka User-friendly SVN before 1.0.9 allows XSS via SVN logs...
CVE-2020-5414
VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...
Design/Logic Flaw
VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...
CVE-2020-16136
In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can download any file on the server machine accessible by the owner of the server process via directory traversal ../ sequences in /Administration/Logs/ requests. The attacker is unable to enumerate files,...
Log injection in uvicorn
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...
@architect-io/cli (>=0.3.13 <=0.5.2-rc.7), @mishguru/logview-cli (>=4.0.0 <=4.6.0) +8 more potentially affected by CVE-2020-15125 via auth0 (>=0.8.5 <=2.25.1)
auth0 NPM version =0.8.5, =0.3.13, =4.0.0, =0.0.34, =3.1.0, =0.0.0, =0.1.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2020-15125 Source advisory: OSV:GHSA-5JPF-PJ32-XX53...
Baldr Botnet Panel Shell Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Baldr Botnet Panel Shell Upload Exploit', 'Description' = %q This module exploits a arbitrary file upload vulnerability within the Baldr stealer...
Encode OSS Uvicorn Resource Management Error Vulnerability
Encode OSS Uvicorn is a British Encode OSS company based on uvloop and httptools build ASGI Web Server Gateway Interface server. Encode OSS Uvicorn suffers from a Resource Management Error vulnerability, which arises from mismanagement of system resources e.g., memory, disk space, files, etc. in ...
CVE-2020-4405
IBM Verify Gateway IVG 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484...
CVE-2020-4405
IBM Verify Gateway IVG 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484...
CVE-2020-7694
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...
Design/Logic Flaw
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...
UBUNTU-CVE-2020-7694
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...
CVE-2020-7694
This affects all versions of package uvicorn. The request logger provided by the package is vulnerable to ASNI escape sequence injection. Whenever any HTTP request is received, the default behaviour of uvicorn is to log its details to either the console or a log file. When attackers request craft...
NY Charges First American Financial for Massive Data Leak
In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. had exposed approximately 885 million records related to mortgage deals going back to 2003. On Wednesday, regulators in New York announced that First American was the targ...