Prototype Pollution

safe-eval is vulnerable to Prototype Pollution. The vulnerability exists in safeEval in index.js due to sandbox escaping which allows an attacker to access the host error objects during the generation of a stack trace...

CVE-2023-24402

creationtimestamp| type| source ---|---|--- 2023-04-07 12:27:47+00:00| seen| https://t.me/cibsecurity/61645...

WildFly: possible information disclosure

A flaw was found in WildFly. This flaw allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

CVE-2023-27487

A flaw was found in envoy. The header x-envoy-original-path should be an internal header, but Envoy does not remove this header from the request at the beginning of request processing when it is sent from an untrusted client. The faked header could then be used for trace logs and grpc logs, used ...

PT-2023-4171 · Schneider Electric +1 · Schneider Electric +1

Name of the Vulnerable Software and Affected Versions: CODESYS affected versions not specified Schneider Electric affected versions not specified Description: The issue is related to a stack-based out-of-bounds write vulnerability in the CmpTraceMgr component. This vulnerability can be exploited ...

The vulnerability of the Trace View web instrumentation panel in Grafana allows attackers to escalate their privileges and perform cross-site scripting attacks.

The vulnerability of the Trace View web instrumentation panel in Grafana relates to insufficient protection of the web page structure when processing values of attributes and resources within a range. Exploiting this vulnerability allows an attacker to enhance their privileges and perform...

CVE-2023-1550

Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when...

CVE-2023-1550

Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when...

Design/Logic Flaw

Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when...

CVE-2023-1550 NGINX Agent vulnerability CVE-2023-1550

Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when...

CVE-2023-1550 NGINX Agent vulnerability CVE-2023-1550

Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when...

K000133135: NGINX Agent vulnerability CVE-2023-1550

Security Advisory Description NGINX Agent inserts sensitive information into a log file. CVE-2023-1550 Impact An authenticated attacker with local access to read agent log files may gain access to private keys. This issue is only exposed when the non-default trace level logging is enabled. Note :...

PT-2023-20786 · Liblouis +6 · Liblouis +6

Name of the Vulnerable Software and Affected Versions: Liblouis Lou Trace version 3.24.0 Description: A Buffer Overflow issue allows a remote attacker to cause a denial of service via the resolveSubtable function at compileTranslationTabel.c. This issue can be exploited to disrupt service...

Malicious Package

Overview owa-trace is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

CVE-2023-27904

A flaw was found in Jenkins. The affected version of Jenkins prints an error stack trace on agent-related pages when agent connections are broken. This stack trace may contain information about Jenkins configuration that is otherwise inaccessible to attackers...

CVE-2023-27904

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers...

Wireshark Security Update (wnpa-sec-2023-08) - Linux

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

Intel® oneAPI Toolkits Advisory

Summary: Potential security vulnerabilities in some Intel® oneAPI Toolkits may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2022-25987 Description: Improper handling of Unicode encoding in source...

CVE-2023-1286

creationtimestamp| type| source ---|---|--- 2023-03-09 14:20:10+00:00| seen| https://t.me/cibsecurity/59722...

CVE-2023-27904

CVE-2023-27904 is active in Jenkins/Jenkins-2-plugins deployments per multiple security advisories (RHSA) and Nessus findings. The issue is information disclosure: when agent connections fail, error stack traces may reveal Jenkins configuration details to an attacker. Affected environments includ...