PT-2024-5887

Name of the Vulnerable Software and Affected Versions go-retryablehttp versions prior to 0.7.7 Description The issue is related to the lack of sanitization of URLs when writing them to the log file. This could allow an attacker to obtain confidential HTTP basic authentication credentials...

PT-2024-28016 · Sonarqube · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarQube versions prior to 10.4 SonarQube version 9.9.4 LTA and earlier Description: The issue concerns the potential exposure of encrypted values in cleartext as part of URL parameters in logs, such as SonarQube Access Logs and Proxy Logs...

PT-2024-4207 · Schneider Electric · Spacelogic As-B

Name of the Vulnerable Software and Affected Versions: Schneider Electric SpaceLogic AS-P and SpaceLogic AS-B affected versions not specified Description: The issue is related to the exposure of sensitive information, specifically SNMP credentials, through log files. This could allow a remote...

SUSE CVE-2024-36127

apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5...

matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

Introduction In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides a redundant copy in case all devices are lost. The key backup uses asymmetric cryptography, with each server-side key backup assign...

PT-2024-12906 · Ibm · Ibm Watson Cp4D Data Stores

Name of the Vulnerable Software and Affected Versions: IBM Watson CP4D Data Stores versions 4.0.0 through 4.8.4 Description: The issue concerns the storage of potentially sensitive information in log files by IBM Watson CP4D Data Stores, which could be accessed by a local user. Recommendations: F...

PT-2024-14712 · Kde · Libksieve

Name of the Vulnerable Software and Affected Versions: KDE libksieve versions prior to 23.03.80 Description: The issue arises from a mistake in kmanagesieve/session.cpp where a username variable is accidentally assigned a password value, resulting in cleartext passwords being placed in server log...

PT-2024-24600

Name of the Vulnerable Software and Affected Versions Sentry versions prior to 24.4.1 Description Sentry is an error tracking and performance monitoring platform. When authenticating as a superuser to Sentry with a username and password, the password is leaked as cleartext in logs under the event...

Nozomi Networks Guardian/CMC 安全漏洞

Nozomi Networks Guardian/CMC is a centralized management console from Nozomi Networks, USA. A security vulnerability exists in Nozomi Networks Guardian/CMC versions prior to v23.4.1 that stems from an audit log of an OpenAPI request that may contain sensitive information, which could lead to...

PT-2024-19637 · WordPress · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads – Sell Digital Files & Subscriptions plugin for WordPress versions up to, and including, 3.2.9 Description: The issue allows unauthenticated attackers to download the debug log via Directory Listing, potentially exposin...

PT-2024-19195 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered where cleartext passwords and hashes are exposed through log files. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and...

CVE-2024-20292

A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. This vulnerability is due to improper storage of an unencrypted registry key in certain...

CVE-2024-23758

An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstallermsi.log file...

IBM Cloud Pak for Security Log Information Disclosure Vulnerability

IBM Cloud Pak for Security is an application from International Business Machines IBM, Inc. an open security platform that connects to your existing data sources to generate deeper insights and enable you to take automated action faster. A log information disclosure vulnerability exists in IBM...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

Shanxi Diankeyun Technology NODERP Security Vulnerability

Shanxi Diankeyun Technology NODERP is an ERP system from Shanxi Diankeyun Technology. A security vulnerability exists in Shanxi Diankeyun Technology NODERP version 6.0.2, which stems from an issue with the file /runtime/log, which could result in an accessible file or directory...

PT-2024-4789

Name of the Vulnerable Software and Affected Versions: VMware Cloud Director Object Storage Extension affected versions not specified Description: The issue concerns an Insertion of Sensitive Information, where a malicious actor with adjacent access to web/proxy server logging may obtain sensitiv...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

CVE-2023-6746

An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an adversary in the middle attack when combined with other phishing techniques. To exploit this, an attacker would need access to the...

Google nodejs-firestore Security Vulnerability

Google nodejs-firestore is a NoSQL document database by Google, Inc. A security vulnerability exists in Google nodejs-firestore versions prior to 6.1.0, which stems from the presence of potential logging that could be exposed to anyone with log read access...