GHSA-VGH3-MWXQ-RCP8 Hashicorp Vault may expose sensitive log information

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

Hashicorp Vault may expose sensitive log information

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

CVE-2024-0831

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

Input validation

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

CVE-2024-0831

Summary: CVE-2024-0831 affects HashiCorp Vault and Vault Enterprise. When an audit device is enabled with the log_raw option, sensitive information may be logged to other audit devices, even if those devices are not configured to use log_raw. This creates a potential information disclosure in log...

CVE-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

CVE-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

CVE-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device

Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw...

Vault May Expose Sensitive Information When Configuring An Audit Log Device

Summary Vault and Vault Enterprise “Vault” may expose sensitive information when enabling an audit device which specifies the lograw option, which may log sensitive information to other audit devices, regardless of whether they are configured to use lograw . This vulnerability, CVE-2024-0831, was...

Cross Site Scripting (XSS)

superbig/craft-audit is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper sanitization of titles within the application. An attacker can inject arbitrary JavaScript via a title to perform a XSS attack...

GHSA-WR2V-9RPQ-C35Q Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records

Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV...

Etcd Gateway TLS authentication only applies to endpoints detected in DNS SRV records

Vulnerability type Cryptography Workarounds Refer to the gateway documentation. The vulnerability was spotted due to unclear documentation of how the gateway handles endpoints validation. Detail When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV...

GHSA-2XHQ-GV6C-P224 Etcd Gateway can include itself as an endpoint resulting in resource exhaustion

Vulnerability type Denial of Service Detail The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesti...

Etcd Gateway can include itself as an endpoint resulting in resource exhaustion

Vulnerability type Denial of Service Detail The etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesti...

Improper Preservation of Permissions in etcd

Vulnerability type Access Controls Detail etcd creates certain directory paths etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients with restricted access permissions 700 by using the os.MkdirAll. This functio...

Craft CMS Audit Plugin Cross Site Scripting vulnerability

Cross Site Scripting XSS vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation...

GHSA-V89Q-C273-3P42 Craft CMS Audit Plugin Cross Site Scripting vulnerability

Cross Site Scripting XSS vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation...

CVE-2023-36259

Cross Site Scripting XSS vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation...

CVE-2023-36259

CVE-2023-36259 affects Craft CMS Audit Plugin prior to version 3.0.2. The issue arises from improper sanitization in the plugin’s handling of titles, enabling Cross Site Scripting (XSS) that can allow an attacker to inject arbitrary JavaScript during user creation. Several sources corroborate XSS...

Pixel & tonic Craft CMS Security Vulnerability

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic USA. A security vulnerability exists in Craft CMS Audit Plugin versions prior to 3.0.2. An attacker can exploit the vulnerability to execute arbitrary code...