CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Session fixation

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Session fixation

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759

Graylog prior to 4.1.2 is affected by a Session ID leak in the DEBUG log file that allows an attacker to escalate privileges to the leaked session ID. Affected product: Graylog (before 4.1.2). Root cause: leakage of session IDs via DEBUG logs. Impact: potential privilege elevation with the leaked...

CVE-2021-37760

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37760

CVE-2021-37760 affects Graylog prior to version 4.1.2. The vulnerability is a Session ID leak in the audit log that can enable an attacker to escalate privileges to the leaked session’s access level. The issue’s root cause is the exposure of session identifiers in audit logs, allowing escalation ...

PT-2021-21863

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 4.1.2 Description: A Session ID leak in the DEBUG log file allows attackers to escalate privileges to the access level of the leaked session ID. Recommendations: For Graylog versions prior to 4.1.2, update to version...

PT-2021-21865

Name of the Vulnerable Software and Affected Versions: Graylog versions prior to 4.1.2 Description: A Session ID leak in the audit log allows attackers to escalate privileges to the access level of the leaked session ID. Recommendations: For versions prior to 4.1.2, update to version 4.1.2 or lat...

Graylog log information leakage vulnerability

Graylog is a centralized log management solution from Graylog, Inc. The product supports capturing, storing, and analyzing logs in real-time, among other things. graylog suffers from a permission permission and access control issue vulnerability that stems from a session ID leak in audit logs pri...

CVE-2021-37760: Insertion of Sensitive Information into Log File

A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

CVE-2021-37759: Insertion of Sensitive Information into Log File

A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges to the access level of the leaked session ID...

Graylog log information leakage vulnerability

Graylog is a centralized log management solution from Graylog USA. The product supports capturing, storing and analyzing logs in real time, among other things. Graylog suffers from a privilege permission and access control issue vulnerability that stems from a session ID leak in the DEBUG log fil...

com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count (>=1.2.0, <=2.2.1), com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (>=3.0.0, <=3.1.1) +32 more potentially affected by CVE-2020-7020 via org.elasticsearch:elasticsearch (5.6.12)

org.elasticsearch:elasticsearch MAVEN version 5.6.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch:elasticsearch and may be impacted: - com.airbus-cyber-security.graylog:graylog-plugin-aggregation-count =1.2.0, =3.0.0, =1.2.0, =1.0....

Cross-Site Scripting in graylog-web-interface

All versions of graylog-web-interface are vulnerable to Cross-Site Scripting XSS. The package fails to escape output on the TypeAhead and QueryInput components, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation No fix is currently available. Conside...

GHSA-9QGH-7PGP-HP7R Cross-Site Scripting in graylog-web-interface

All versions of graylog-web-interface are vulnerable to Cross-Site Scripting XSS. The package fails to escape output on the TypeAhead and QueryInput components, which may allow attackers to execute arbitrary JavaScript on the victim's browser. Recommendation No fix is currently available. Conside...

PT-2020-21205

Name of the Vulnerable Software and Affected Versions graylog-web-interface versions all versions Description The issue concerns a failure to escape output on the TypeAhead and QueryInput components, potentially allowing attackers to execute arbitrary JavaScript on the victim's browser through...