Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

cargo-audit-0.20.0~git66.972ac93-3.1 on GA media (moderate)

cargo-audit-0.20.0git66.972ac93-3.1 on GA media Announcement ID: openSUSE-SU-2024:14363-1 Rating: moderate Cross-References: CVE-2024-45405 CVSS scores: CVE-2024-45405 SUSE : 6.4 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2024-45405 SUSE : 7...

Protecting your privacy: Opera has completed an independent no-log audit of its free browser VPN

Privacy Protecting your privacy: Opera has completed an independent no-log audit of its free browser VPN Share September 25th, 2024 Hi Opera users! We are excited to announce that we have successfully completed an independent audit of our no-log policy for Opera’s free browser VPN available on...

OPENSUSE-SU-2024:14363-1 cargo-audit-0.20.0~git66.972ac93-3.1 on GA media

These are all security issues fixed in the cargo-audit-0.20.0git66.972ac93-3.1 package on the GA media of openSUSE Tumbleweed...

The vulnerability of HashiCorp’s Vault and Vault Enterprise file archiving platforms lies in the fact that inserting confidential information into the log file allows a perpetrator to access this confidential information.

The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms lies in the fact that open text values for client tokens and token accessories are stored in an audit log. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

D-Link DAR-7000 Operating System Command Injection Vulnerability

D-Link DAR-7000 is an Internet Behavior Audit Gateway from China AUO D-Link. An OS command injection vulnerability exists in the D-Link DAR-7000 20240912 and earlier versions, which stems from the parameter host in the file /view/DBManage/BackupServercommit.php that can lead to OS command...

ROS-20240918-13

A vulnerability in HashiCorp's Vault and Vault Enterprise enterprise information archiving platforms is related to storing the plaintext values of client tokens and token accessors in the audit log auditing. Exploitation of the vulnerability could allow an attacker to gain access to sensitive...

Successful user login events using PAT does not update last login date and are not added to the audit logs

h3. Issue Summary When users authenticate on Confluence, this information should be update last login date as well as add as new events on the audit log when full coverage is enabled for the Security category. Requests made with personal access tokens PAT for REST API won't create a new entry on...

CVE-2024-8059

IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters...

CVE-2024-45105

An internal product security audit discovered a UEFI SMM System Management Mode callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-45105

An internal product security audit discovered a UEFI SMM System Management Mode callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-45105

An internal product security audit discovered a UEFI SMM System Management Mode callout vulnerability in some ThinkSystem servers that could allow a local attacker with elevated privileges to execute arbitrary code...

CVE-2024-8059

CVE-2024-8059 concerns Lenovo XClarity Controller (XCC). The issue arises from the exposure of IPMI credentials in XCC audit log entries when the account username length is 16 characters. Affected software is Lenovo XCC; the root cause is credentials being captured in logs, leading to potential e...

CVE-2024-8059

IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters...

CVE-2024-8059

IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters...

PT-2024-38780 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: The issue concerns the exposure of IPMI credentials in XCC audit log entries. This occurs when the account username length is 16 characters. Recommendations: At the moment, there is no...

Lenovo XClarity Controller 安全漏洞

Lenovo XClarity Controller Lenovo XCC is a server embedded management engine from Lenovo China. It is primarily used to standardize and automate basic server management tasks. A security vulnerability exists in Lenovo XClarity Controller that stems from the fact that IPMI credentials may be...

PT-2024-31435 · Lenovo · Lenovo Thinksystem Servers

Name of the Vulnerable Software and Affected Versions: Lenovo ThinkSystem servers affected versions not specified Description: An internal product security audit discovered a UEFI SMM System Management Mode callout issue in certain ThinkSystem servers. This could allow a local attacker with...

The vulnerability of the Zabbix universal monitoring system, related to the storage of passwords in an open manner, allows a intruder to access confidential information.

The vulnerability of the Zabbix universal monitoring system lies in the ability to view unprotected text passwords in the audit log, where the passwords are displayed as plain text. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to confidential...

The vulnerability of the audit plugin (of the TracePluginImpl class in the TracePluginImpl module) of the “Red Database” database management system allows a perpetrator to influence audit records.

The vulnerability of the audit plugin of the TracePluginImpl class within the TracePluginImpl module of the “Red Database” database management system relates to the possibility of assigning incorrect severity and facility parameters to certain events when these events are recorded in the OS syslo...