[SECURITY] [DSA 5812-1] postgresql-15 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5812-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 15, 2024 https://www.debian.org/security/faq -...

ROS-20241015-15

A vulnerability in the PHP programming language interpreter exists due to a failure to take measures to neutralize the special elements. Exploitation of the vulnerability could allow an attacker acting remotely to Affect the confidentiality, integrity, and availability of protected information...

BIT-PHP-2024-9026 PHP-FPM logs from children may be altered

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

CVE-2024-9026

A flaw was found in PHP-FPM, the FastCGI Process Manager. This vulnerability can allow an attacker to manipulate or remove up to 4 characters from log messages via crafted log content, potentially polluting or altering the final log. If PHP-FPM is configured to use syslog output, further log data...

AZL-50144 CVE-2024-9026 affecting package php for versions less than 8.1.30-1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

CVE-2024-9026 PHP-FPM logs from children may be altered

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

CVE-2024-9026 PHP-FPM logs from children may be altered

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

CVE-2024-9026

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catchworkersoutput = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log...

CVE-2024-9026

CVE-2024-9026 is a PHP-FPM log manipulation vulnerability. When catch_workers_output is enabled, local attackers may pollute log output or remove up to 4 characters from log messages, with potential additional data loss if syslog output is used. Affected: PHP 8.1.x before 8.1.30, 8.2.x before 8.2...

PHP 安全漏洞

PHP is a scripting language for PHP that executes on the server side. A security vulnerability exists in PHP that stems from the possibility of contaminating the final log or removing up to four characters from a log message by manipulating the contents of the log message...

CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...

CVE-2024-31845

Italtel Embrace 1.6.4 contains a logging input handling issue: output written to logs is not properly neutralized, with a GET query string parameter being used for log entries. An attacker can modify this parameter to attribute actions to a different user, and the issue is exploitable without aut...

CVE-2024-31845

An issue was discovered in Italtel Embrace 1.6.4. The product does not neutralize or incorrectly neutralizes output that is written to logs. The web application writes logs using a GET query string parameter. This parameter can be modified by an attacker, so that every action he performs is...

CVE-2024-27097

CVE-2024-27097 corresponds to a log-injection vulnerability in CKAN where an input parameter sent to the user/reset endpoint was not filtered before being logged, enabling potential false log entries or log-file corruption. The issue affects CKAN, with fixed versions 2.9.11 and 2.10.4. Remediatio...

CVE-2023-38020

IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files. IBM X-Force ID: 260576...

IBM SOAR QRadar Plugin App Log Injection Vulnerability

The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. A log injection vulnerability exists in the IBM SOAR QRadar Plugin App, which can be exploited by an attacker to manipulate the...

CVE-2024-0987 Sichuan Yougou Technology KuERP log neutralization for logs

A vulnerability classified as critical has been found in Sichuan Yougou Technology KuERP up to 1.0.4. Affected is an unknown function of the file /runtime/log. The manipulation leads to improper output neutralization for logs. The exploit has been disclosed to the public and may be used. The...

User Activity Tracking and Log < 4.1.4 - IP Spoofing

Description This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. PoC 1. Add X-Forwarded-For: 11.11.11.11 to any request which will be in activity log. For example in creation of new post. 2. View the activity log and see that...

CVE-2015-10011 OpenDNS OpenResolve endpoints.py neutralization for logs

A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipulation leads to improper output neutralization for logs. The identifier of the patch is 9eba6ba5abd89d0e36a008921eb307fcef8c5311. It is...

PT-2022-25509 · Unknown · Banhammer Plugin

Name of the Vulnerable Software and Affected Versions: Banhammer Plugin affected versions not specified Description: A vulnerability has been found in the Banhammer Plugin, affecting the HTTP Header Handler component. The manipulation of the X-Forwarded-For argument leads to improper output...