CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-2204

CVE-2011-2204 affects Apache Tomcat when MemoryUserDatabase logs password data on JMX user creation errors. Affected: Tomcat 5.5.x < 5.5.34, 6.x < 6.0.33, 7.x

CVE-2011-2204

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-2204

Removed by vendor...

CVE-2011-2204: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file...

PT-2011-3680

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.18 Description The issue allows local users to obtain sensitive information by reading a log file when the...

ruby WEBrick log escape sequence

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrar...

CVE-2011-0197

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

CVE-2011-0197

CVE-2011-0197 affects Apple Mac OS X (App Store) prior to 10.6.8, where App Store could log a user’s AppleID password to a local file with insufficient permissions, enabling local users to read the password. The root cause is credentials being written to a log entry; an improved handling of crede...

CVE-2011-0197

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

PT-2011-2177

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.6.8 Description The issue allows local users to potentially obtain sensitive information by reading a log file. This is because the App Store in Apple Mac OS X creates a log entry containing a user's AppleID...

CVE-2011-0197: Exposure of Sensitive Information to an Unauthorized Actor

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

CVE-2011-1943

The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file...

Design/Logic Flaw

The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-1943

The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file...

CVE-2011-1943

CVE-2011-1943 affects NetworkManager 0.8.999-3.git20110526 in Fedora 15, where the destroy_one_secret function in nm-setting-vpn.c (libnm-util) logs a certificate password. The log entry can be read by local users, allowing disclosure of sensitive information. Impact is limited to confidentiality...

CVE-2011-1943

The destroyonesecret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive information by reading a log file...

PT-2011-3488

Name of the Vulnerable Software and Affected Versions NetworkManager version 0.8.999-3.git20110526 Description The issue allows local users to obtain sensitive information by reading a log file, due to a certificate password being logged by the destroy one secret function in nm-setting-vpn.c in t...

Fedora Update for fail2ban FEDORA-2011-5151

Check for the Version of fail2ban OpenVAS Vulnerability Test Fedora Update for fail2ban FEDORA-2011-5151 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Code injection

The SPICE Firefox plug-in spice-xpi 2.4, 2.3, 2.2, and possibly other versions allows local users to overwrite arbitrary files via a symlink attack on the usbrdrctl log file, which has a predictable name...