Design/Logic Flaw

IBM ServerGuide before 9.63, UpdateXpress System Packs Installer UXSPI before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file...

CVE-2014-4835

The CVE-2014-4835 issue affects IBM ServerGuide before 9.63, UpdateXpress System Packs Installer (UXSPI) before 9.63, and ToolsCenter Suite before 9.63. The root cause is credentials being written to log files, enabling a local user to read sensitive information. Impact is partial confidentiality...

CVE-2014-4835

IBM ServerGuide before 9.63, UpdateXpress System Packs Installer UXSPI before 9.63, and ToolsCenter Suite before 9.63 place credentials in logs, which allows local users to obtain sensitive information by reading a file...

Vimeo: CRITICAL full source code/config disclosure for Cameo

Hi! The server at https://ci.cameo.tv/ has directory listing on and seems to host quiet a few debian packages containing extremely sensitive information database paswords, API keys, you name it. One example is the config package containing 16 config files, even personal ones containing local...

Sanitize passwords when Network Traffic debugging is enabled

Login attempts for users managed externally i.e. JIRA/Crowd logs the user's password in FishEye logs if the Network Traffic is enabled. I think the password should be sanitized, because: This information is generally not important for troubleshooting of most issues. Users would have sensitive...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

WordPress All In One WP Security & Firewall Plugin <= 3.8.9 - CSRF

Because of this vulnerability, attacker can hijack the authentication of administrators for requests that delete logs of 404 HTTP status codes. Solution Update the plugin...

CVE-2012-0262

creationtimestamp| type| source ---|---|--- 2015-01-05 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/41687 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/op5welcome.rb 2025-02-06 03:13:40+00:00| seen|...

IBM Rational AppScan Source Information Disclosure Vulnerability

IBM Rational AppScan Source now known as IBM Security AppScan Source is a set of Web-based multi-user application security testing solution from IBM in the United States. The solution supports simultaneous scanning of multiple applications, intelligent repair remediation and so on. A security...

UBUNTU-CVE-2014-9680

sudo before 1.8.12 does not ensure that the TZ environment variable is associated with a zoneinfo file, which allows local users to open arbitrary files for read access but not view file contents by running a program within an sudo session, as demonstrated by interfering with terminal output,...

Code injection

IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs...

CVE-2014-6123

IBM Rational AppScan Source 8.0 through 8.0.0.2 and 8.5 through 8.5.0.1 and Security AppScan Source 8.6 through 8.6.0.2, 8.7 through 8.7.0.1, 8.8, 9.0 through 9.0.0.1, and 9.0.1 allow local users to obtain sensitive credential information by reading installation logs...

CVE-2014-6123

The CVE-2014-6123 entry affects IBM Rational AppScan Source and related Security AppScan Source versions up to 9.0.1, where local users can read installation logs to obtain sensitive credential information. Affected products include Rational AppScan Source 8.0–8.0.2, 8.5–8.5.0.1, and Security App...

Cisco Adaptive Security Appliance Software Information Leak in Syslog Messages Vulnerability

A vulnerability in the syslog management subsystem of devices running Cisco Adaptive Security Appliance ASA Software may allow an unauthenticated, remote attacker to access sensitive information. The vulnerability is due to improper sanitization of syslog messages. An attacker could exploit this...

MercadoPago Android App Information Disclosure

Advisory ID Internal CORE-2014-0011 1. Advisory Information Title: MercadoPago Android App Information Disclosure Advisory ID: CORE-2014-0011 Date published: 2014-12-19 Date of last update: 2014-12-17 Vendors contacted: Mercadolibre Release mode: Coordinated release 2. Vulnerability Information...

EAP6: Plain text password logging during security audit

It was found that the security audit functionality logged request parameters in plain text. This may have caused passwords to be included in the audit log files when using BASIC or FORM-based authentication. A local attacker with access to audit log files could possibly use this flaw to obtain...

Cisco Unified Computing System Manager Information Disclosure Vulnerability

A vulnerability in the system logs of the Cisco Unified Computing System Manager could allow an unauthenticated, remote attacker to view sensitive system information. The vulnerability is due to the inclusion of sensitive information in certain log files. An attacker could exploit this...

CVE-2014-6075

IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, place credentials in URLs, which allows remote attackers to obtain sensitive information by reading 1 web-server access logs, 2 web-serv...

Veeam Agent for Microsoft Windows: Service suddenly stopped working.

Challenge While running Veeam Agent for Microsoft Windows VAW, the Control Panel displays the error: Services suddenly stopped working. Cause The Veeam Agent for Microsoft Windows Control Panel has lost contact with the Veeam Agent for Microsoft Windows service on the local machine. Possible caus...

JVN#89852154: iLogScanner vulnerable to cross-site scripting

iLogScanner provided by INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN IPA is a software that checks access logs to detect suspected attacks against a web server. iLogScanner contains a cross-site scripting vulnerability CWE-79 due to a flaw when processing analysis results and outputting the...