IBM Security Verify Information Queue 授权问题漏洞

IBM Security Verify Information Queue is a cross-product integrator that leverages Kafka technology and a publish/subscribe model to integrate data between IBM security products. An elevation of privilege vulnerability exists in IBM Security Verify Information Queue. The vulnerability stems from...

CVE-2020-25646: Improper Output Neutralization for Logs

A flaw was found in Ansible Collection community.crypto. opensslprivatekeyinfo exposes private key in logs. This directly impacts confidentiality...

CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

CVE-2020-14330: Insertion of Sensitive Information into Log File

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

CVE-2020-14332: Improper Output Neutralization for Logs

A flaw was found in the Ansible Engine when using moduleargs. Tasks executed with check mode --check-mode do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality...

CVE-2020-14330

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

MGASA-2020-0363 Updated ansible package fixes security vulnerabilities

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

Updated ansible package fixes security vulnerabilities

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

Cross-Site Scripting in mermaid

Versions of mermaid prior to 8.2.3 are vulnerable to Cross-Site Scripting. If malicious input such as A"" is provided to the application, it will execute the code instead of rendering it as text due to improper output encoding. Recommendation Upgrade to version 8.2.3 or later...

PT-2020-21536

Name of the Vulnerable Software and Affected Versions mermaid versions prior to 8.2.3 Description The issue allows for Cross-Site Scripting attacks. If malicious input, such as A"", is provided to the application, it will execute the code instead of rendering it as text due to improper output...

Ansible: masked keys for uri module are exposed into content and json output

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

It is an open-source collection of pre-built vulnerable docker environments. The primary CVE ID is not explicitly stated, but the repository contains various vulnerable environments and exploits for different vulnerabilities, including CVE-2016-9086, CVE-2017-1000353, CVE-2013-4547,...

CVE-2019-14854: Improper Output Neutralization for Logs

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged...

CVE-2019-14864: Improper Output Neutralization for Logs

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag nolog set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data...

Contao Output Improperly Encoded or Escaped Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. An improper output encoding or escaping vulnerability exists in Contao versions 4.8.4 and 4.8.5. An attacker can exploit this vulnerability by...

PT-2019-15924

Name of the Vulnerable Software and Affected Versions Contao versions 4.8.4 through 4.8.5 Description The issue concerns improper encoding or escaping of output, allowing the injection of insert tags into the login module. These tags are replaced when the page is rendered. Recommendations For...

CVE-2019-10213: Improper Output Neutralization for Logs

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator b...

CVE-2019-14858: Improper Output Neutralization for Logs

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argumentspec with sub parameters marked as nolog, passing an invalid parameter name to the module will cause the task to fail before the nolog options in the sub parameters are processe...

PT-2019-13859

Name of the Vulnerable Software and Affected Versions PRiSE adAS version 1.7.0 Description An issue was discovered where the OPENSSO module does not properly escape output on error, leading to reflected XSS. Recommendations For PRiSE adAS version 1.7.0, consider disabling the OPENSSO module until...

CVE-2019-9852: Improper Encoding or Escaping of Output

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...