Microsoft Office SharePoint CVE-2019-1032 Cross Site Scripting Vulnerability

Description Microsoft Office SharePoint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUESTLOGGER.undertowRequestFailedt, exchange...

CVE-2019-10159

A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs...

NetScaler MAS /var/ space being filled up by postgresql logs

The following SNMP Trap maybe received: MAS NC: High System Disk Usage This trap is sent when the Disk utilization goes high. System Disk Usage and Disk Usage High: 80% will show specific failure information: 80% Severity: MinorSNMPVersion = 2notify = .1.3.6.1.4.1.5951.7.1.2.35Node =...

Security Bulletin: IBM MQ Advanced Cloud Pak may print out plain text credentials in logs. (CVE-2019-4239)

Summary An issue was found within the IBM MQ Advanced Cloud Pak that would cause plain text passwords to be printed in the container logs. If these logs were mirrored to an external logging service, such as the logging service in IBM Cloud Private, then they would be visible there. Vulnerability...

CVE-2019-12310

ExaGrid appliances with firmware version v4.8.1.1044.P50 have a /monitor/data/Upgrade/ directory traversal vulnerability, which allows remote attackers to view and retrieve verbose logging information. Files within this directory were observed to contain sensitive run-time information, including...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability (macOS)

The version of Fortinet FortiClient Mac running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only ...

Fortinet FortiClient 6.2.x < 6.2.1 Missing Encryption Of Sensitive Data Vulnerability

The version of Fortinet FortiClient running on the remote host is prior to 6.2.1. It is, therefore, affected by a missing encryption of sensitive data vulnerability. An attacker can access VPN session cookie from an endpoint device running FortiClient. The attacker can steal the cookies only if...

pacemaker: Information disclosure through use-after-free

A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs...

pacemaker: Information disclosure through use-after-free

A use-after-free flaw was found in pacemaker which could result in certain sensitive information to be leaked via the system logs...

Remote Code Execution (RCE)

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 3.11.51. See the following advisory for the container...

Findomain - A Cross-Platform Tool That Use Certificate Transparency Logs To Find Subdomains

A cross-platform tool that use Certificates Transparency logs to find subdomains. We currently support Linux, Windows and MacOS. How it works? It tool doesn't use the common methods for subdomains discover, the tool uses Certificate Transparency logs to find subdomains and it method make it tool...

JeeWeb login logs have xss vulnerability

JeeWeb is an agile development system based on SpringBoot 2 + Spring + Mybatis + Hibernate . An xss vulnerability exists in the JeeWeb login log, which can be exploited by an attacker to obtain an administrator cookie...

The vulnerability of the mydlink web interface of D-Link routers allows a hacker to obtain DNS query logs and user login logs.

The vulnerability of the D-Link microprogrammed router’s web interface function “mydlink” is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to obtain DNS query logs and user login logs by sending specially crafted...

CVE-2019-6158

An internal product security audit of Lenovo XClarity Administrator LXCA discovered HTTP proxy credentials being written to a log file in clear text. This only affects LXCA when HTTP proxy credentials have been configured. This affects LXCA versions 2.0.0 to 2.3.x...

Information Disclosure

admin-cli in Red Hat JBoss Enterprise Application Platform is vulnerable to information disclosure. This vulnerability exists due to EAP feature to download server log files that allows logs to be available via GET requests causing cross-origin attacks. An attacker could trigger the user's browse...

Information Disclosure

The 389 Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. A flaw was found in the way 389 Directory Server handled password changes. If an LDAP user has changed thei...

CVE-2019-4047

IBM Jazz Reporting Service JRS 6.0.6 could allow an authenticated user to access the execution log files as a guest user, and obtain the information of the server execution. IBM X-Force ID: 156243...

Workspace App Android "restoring data connection" message when EDT is enabled

On the GUI we see a "restoring data connection" message but the connection is not restored. This happens when EDT is enabled viaHDXoverUDP=preferred Studio Policy and NetScaler DTLS enabled setting if connecting from outside the network. On the logs we might see similar messages as the following:...