Path traversal

Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi...

CVE-2020-11491

Monitoring::Logs in Zen Load Balancer 3.10.1 allows remote authenticated admins to conduct absolute path traversal attacks, as demonstrated by a filelog=/etc/shadow request to index.cgi...

ipa: Batch API logging user passwords to /var/log/httpd/error_log

A flaw was found in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA masters. Batch processing of commands with passwords as arguments or options is not performed by default in FreeIPA but is possible by third-party...

rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c

An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter in this case, a space or a colon, but fails to account for strings that do not satisfy this constraint. If...

CVE-2020-7599

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-31388)

Android is a free and open source operating system from Google based on the Linux kernel without GNU components. An unspecified vulnerability exists in Samsung mobile devices, which can be exploited by an attacker to obtain and modify user input logs...

CVE-2019-20597

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

CVE-2019-20597

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

Code injection

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

CVE-2019-20597

CVE-2019-20597 affects Samsung mobile devices running N(7.1), O(8.x), and P(9.0). The vulnerability exists in the SPENgesture component, which can allow arbitrary applications to read or modify user-input logs. This impacts confidentiality and integrity (CVSSv3.1: 9.1, CRITICAL; CVSSv2: 6.4, MEDI...

CVE-2019-20597

An issue was discovered on Samsung mobile devices with N7.1, O8.x, and P9.0 software. SPENgesture allows arbitrary applications to read or modify user-input logs. The Samsung ID is SVE-2019-14170 June 2019...

Artica Pandora FMS Information Disclosure Vulnerability (CNVD-2020-20720)

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A security vulnerability exists in Artica Pandora FMS 7.42 and earlier versions. An attacker can exploit the vulnerability...

Storefront | Unable To Join Secondary Storefront Server To Server Group.

ERROR: Unable to join server in existing server group. Add server failed - Add of server XYZ to server group failed. In event logs we could see 'access is denied' exception while running the command : 'Add-DSCertificateToDSStore'...

Information Disclosure

easybuildframework is vulnerable to information disclosure. The vulnerability exists as sensitive information such as the GitHub Personal Access Token are improperly handled and shown in plain text in EasyBuild's debug logs...

GHSA-2WX6-WC87-RMJM GitHub personal access token leaking into temporary EasyBuild (debug) logs

Impact The GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --from-pr, etc. is shown in plain text in EasyBuild debug log files. Scope: the log message only appears in the top-level log file, not in the individual software installation logs see...

PYSEC-2020-41

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

PYSEC-2020-268

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

CVE-2020-5262 GitHub personal access token leaking into temporary EasyBuild (debug) logs

In EasyBuild before version 4.1.2, the GitHub Personal Access Token PAT used by EasyBuild for the GitHub integration features like --new-pr, --fro,-pr, etc. is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the master+ develop branches of the...

DEBIAN-CVE-2020-1753

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl...

CVE-2019-19756

An internal product security audit of Lenovo XClarity Administrator LXCA discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are...