FreeBSD : Gitlab -- vulnerabilities (bcc8b21e-7122-11ef-bece-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bcc8b21e-7122-11ef-bece-2cf05da270f3 advisory. Gitlab reports: Execute environment stop actions as the owner of the stop action job Prevent...

Cleartext Storage Of Sensitive Information

apache-airflow & apache-airflow-providers-cncf-kubernetes are vulnerable to Cleartext Storage Of Sensitive Information. The vulnerability is due to the storage of configuration files without encryption, and plaintext logging of configuration details, allowing an attacker to access the kubernetes...

CVE-2023-51390

CVE-2023-51390 relates to the journalpump daemon, where a logging issue causes the configuration of a service integration (including credentials, if present) to be logged in plaintext to the configured logging pipeline. The flaw allows exposure of sensitive configuration data due to verbose loggi...

CVE-2023-41253

When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K98334513: BIG-IP DNS TSIG key vulnerability CVE-2023-41253

Security Advisory Description When a BIG-IP DNS or BIG-IP LTM system is enabled with the DNS Services license, and a TSIG key is created, the key is logged in plaintext in the audit log. CVE-2023-41253 Impact An authenticated attacker with at least auditor role privileges can view the TSIG key in...

PT-2023-28841 · F5 · Big-Iq +1

Name of the Vulnerable Software and Affected Versions: BIG-IP or BIG-IQ system affected versions not specified Description: The issue occurs when TACACS+ audit forwarding is configured on the system, resulting in the sharedsecret being logged in plaintext in the audit log. Recommendations: At the...

PT-2023-28992 · Ansible · Ansible Automation Platform

Name of the Vulnerable Software and Affected Versions: Ansible Automation platform affected versions not specified Description: A logic flaw exists in the Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows ...

ovirt-log-collector: RHVM admin password is logged unfiltered

A flaw was found in the ovirt-log-collector, which led to the logging of plaintext passwords in the log file. This flaw allows an attacker with sufficient privileges to read the log file, leading to a loss of confidentiality...

CVE-2022-31047

CVE-2022-31047 affects TYPO3: prior to 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials (e.g., database credentials) could be logged as plaintext in exception handlers when logging complete stack traces. A fix was released in the listed versions. Practical ...

CVE-2022-31047 Insertion of Sensitive Information into Log File in typo3/cms-core

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys e.g. database credentials can be logged as plaintext in exception handlers, when logging the complete exception stack trace...

Information disclosure

VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager may be able to view credentials in plaintext within one or...

Primekey Solutions PrimeKey EJBCA 安全漏洞

Primekey Solutions PrimeKey EJBCA is a full-featured CA system software from PrimeKey Solutions Primekey Solutions, Sweden. The software is used for domain certificate management, enrollment and enrollment-to-certificate validation and other functions to achieve access security. A security...

CVE-2021-3447

CVE-2021-3447 describes a vulnerability in several ansible modules where credentials and secrets logged in plain text on managed nodes or controller when verbose mode is used, not protected by no_log. Affected: Red Hat Ansible Automation Platform <1.2.2; Ansible Tower

CVE-2021-21270

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is...

CVE-2021-21270

OctopusDSC is a PowerShell module with DSC resources that can be used to install and configure an Octopus Deploy Server and Tentacle agent. In OctopusDSC version 4.0.977 and earlier a customer API key used to connect to Octopus Server is exposed via logging in plaintext. This vulnerability is...

Unspecified Vulnerability in JetBrains IntelliJ IDEA Ultimate

JetBrains IntelliJ IDEA Ultimate is a Czech JetBrains integrated development environment for the Java language. A security vulnerability exists in JetBrains IntelliJ IDEA Ultimate that originates from the program logging server credentials in plaintext to the IDE configuration file. An attacker...

RSA Archer Information Disclosure Vulnerability (CNVD-2019-08462)

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An information disclosure vulnerability exists in Dell EMC RSA Archer...

Juniper ATP Information Disclosure Vulnerability (CNVD-2019-24380)

Juniper Advanced Threat Prevention ATP is a suite of advanced threat protection platforms from Juniper Networks. The product supports malware detection, file analysis, and malicious IP address and URL blocking. An information disclosure vulnerability exists in Juniper ATP version 5.0.3 prior to...

Information Disclosure

jboss-as-web is vulnerable to information disclosure attacks. The vulnerability exists as the security audit functionality in Red Hat JBoss Enterprise Application Platform EAP 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the l...

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible content on Microsoft's Windows platform with Powershell 5 or higher may disclose sensitive execution details including 'become' passwords, Ansible module arguments, and return values via Powershell's 'suspicious scriptblock logging' feature, which is enabled by default. The...