Gallagher Command Centre Server 安全漏洞

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings. A security vulnerability exists in Gallagher Command Centre Server that stems from the insertion of sensitive information into a log file during the Alarm Sender...

UBUNTU-CVE-2024-47094

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p22, 2.2.0p37, 2.1.0p50 EOL causes remote site secrets to be written to web log files accessible to local site users...

rhosp-director: cleartext passwords exposed in logs

An flaw was found in the OpenStack Platform RHOSP director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs...

Insertion of Sensitive Information into Log File

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of configuration variables belonging to other DAG author users. If these variables...

CVE-2024-10285

The CE21 Suite plugin for WordPress is vulnerable to sensitive information disclosure via the plugin-log.txt in versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to log in the user associated with the JWT token...

Atlantis 日志信息泄露漏洞

Atlantis is a self-hosted golang application from the Atlantis open source. It listens to Terraform pull request events via webhook. Atlantis has a log information disclosure vulnerability that stems from Atlantis logs containing GitHub credentials during rotation. An attacker who could read thes...

CVE-2024-33603

The LevelOne WBR-6012 router has an information disclosure vulnerability in its web application, which allows unauthenticated users to access a verbose system log page and obtain sensitive data, such as memory addresses and IP addresses for login attempts. This flaw could lead to session hijackin...

PT-2024-28779 · Unknown · Boa Web Server +1

Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions 5.16.1.33 and earlier Description: The issue concerns a lack of authentication in the Boa webserver, allowing remote, unauthenticated attackers to retrieve logs containing sensitive system information...

UBUNTU-CVE-2024-38862

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35, 2.1.0p48 and =2.0.0p39 EOL causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators...

PT-2024-28243 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions 2.3.0p18 Checkmk versions 2.2.0p35 Checkmk versions 2.1.0p48 Checkmk versions =2.0.0p39 EOL Description: The issue concerns the insertion of sensitive information into log files in Checkmk, causing SNMP and IMPI secrets of ho...

Nextcloud: Exposing debug.log file leads to server full path disclosure

The debug.log file on the nextcloud.com website was publicly accessible and contained sensitive information, including the server's full directory path. This type of information disclosure could have assisted attackers in understanding the internal structure of the server...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...

PT-2024-39724 · Unknown · Quarkus Cxf

Name of the Vulnerable Software and Affected Versions: Quarkus CXF affected versions not specified Description: A vulnerability was found in Quarkus CXF where passwords and other secrets may appear in the application log despite the user configuring them to be hidden. This issue requires specific...

PT-2024-7426 · Cisco · Cisco Nexus Dashboard Fabric Controller +1

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard Fabric Controller NDFC and Cisco Nexus Dashboard Orchestrator NDO affected versions not specified Description: The issue is related to a logging function in Cisco Nexus Dashboard Fabric Controller NDFC and Cisco Nexus...

CVE-2024-8609

Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information.This issue affects ValeApp: before v2.0.0...

PT-2024-38780 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: The issue concerns the exposure of IPMI credentials in XCC audit log entries. This occurs when the account username length is 16 characters. Recommendations: At the moment, there is no...

CVE-2023-37232

Loftware Spectrum through 4.6 exposes Sensitive Information Logs to an Unauthorized Actor...

CVE-2024-42344

A vulnerability has been identified in SINEMA Remote Connect Client All versions V3.2 SP2. The affected application inserts sensitive information into a log file which is readable by all legitimate users of the underlying system. This could allow an authenticated attacker to compromise the...

The vulnerability of the retryablehttp package, related to the insertion of confidential information into the log file, allows a perpetrator to obtain confidential authentication credentials for HTTP basic authentication.

The vulnerability of the retryablehttp package lies in the lack of cleaning of URL addresses when they are written to the log file. Exploiting this vulnerability can allow an attacker to obtain confidential basic authentication credentials...

go-retryablehttp: url might write sensitive information to log file

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information...