58 matches found
CVE-2021-44862 Sensitive Information store in NSClient logs
Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user c...
GHSA-F4G4-CJ8F-3CR9 OpenStack Nova logs sensitive context from notification exceptions
An issue was discovered in exceptionwrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens...
OpenStack Oslo utility sensitive information exposure via log files
The strutils.maskpassword function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log...
CVE-2022-25248 PTC Axeda agent and Axeda Desktop Server Information Exposure
When connecting to a certain port Axeda agent All versions and Axeda Desktop Server for Windows All versions supplies the event log of the specific service...
CVE-2021-22030
Greenplum Database prior to 5.28.14 and 6.17.0: statements can cause sensitive credential information to be logged, enabling a user with log access to read credentials. Multiple connected sources (Red Hat, NVD, Veracode, OSV, CVE lists) corroborate this disclosure; no explicit exploit details or ...
Email Log < 2.4.8 - Reflected Cross-Site Scripting
The plugin does not escape the d parameter before outputting it back in an attribute in the Log page, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=email-log&d="+style=animation-name:rotation+onanimationstart=alert/XSS///...
All Vulnerabilities for udavinci.edu.mx Patched via Open Bug Bounty
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| udavinci.edu.mx ---|--- Open Bug Bounty...
CVE-2021-35210
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tllog table that will be executed in the browser when the system log is called in the back end...
wildfly: resource adapter logs plaintext JMS password at warning level on connection error
A flaw was found in wildfly. JMS passwords are logged by the resource adaptor in plain text at the warning level when a connection error occurs allowing any user that has access to the log to gain access to this sensitive information. The highest threat from this vulnerability is to data...
CVE-2019-13098
The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 Jel...
CVE-2019-13098
The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated users can read it in the log later. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 Jel...
CVE-2015-1456
Fortinet FortiAuthenticator 3.0.0 logs the PostgreSQL usernames and passwords in cleartext, which allows remote administrators to obtain sensitive information by reading the log at debug/startup/...
CVE-2014-8537
CVE-2014-8537 affects McAfee Network Data Loss Prevention (NDLP) prior to version 9.2.2. The vulnerability allows local users to obtain sensitive information by reading NDLP logs. The available documents confirm the affected product and the basic impact (information disclosure via logs); a deeper...
CVE-2014-7231
The strutils.maskpassword function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log...
CVE-2014-7231
OpenStack Oslo utility library issue CVE-2014-7231 affects Cinder, Nova, and Trove before versions 2013.2.4 and 2014.1 before 2014.1.3. The strutils.mask_password() function did not properly mask passwords in command logs, enabling a local user with read access to logs to retrieve passwords. Reme...
CVE-2014-1279
Apple TV prior to version 6.1 is affected by CVE-2014-1279 due to improper restriction of logging, allowing local users to read log data and obtain sensitive information. The issue targets the logging subsystem and is considered a local-attack impact (no remote vector described). Appleās advisory...
CVE-2012-4529
The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a session, which allows remote attackers to obtain the session id 1 via a man-in-the-middle attack ...
Modifed images can lead to JavaScript/VBScript execution in AIM
Software Effected: AOL Instant Messenger Versions Effected: 4.1 to current including 4.4 alpha, older versions probably effected Details: AOL Instnat Messenger has the ability to embed images into an instant message. The user sends the graphic to the person they wish to show, and the graphic show...