3144 matches found
PT-2025-32447 · Pypi · Pyload-Ng
Summary A log injection vulnerability was identified in pyload in API /json/add package. This vulnerability allows user with add packages permission to inject arbitrary messages into the logs gathered by pyload. Details pyload will generate a log entry when creating new package using API /json/ad...
PYSEC-2025-101
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollectinfooptions.log and syncgateway.log, there are cleartext passwords in redacted and unredacted output...
GO-2025-3780 OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk
OpenBao Inserts Sensitive Information into Log File when processing malformed data in github.com/openbao/openbao/sdk...
CVE-2025-43485
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a privileged user to retrieve credentials from the log files. HP has addressed the issue in the latest software update...
SUSE CVE-2025-46809
A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects Container suse/manager/4.3/proxy-httpd:4.3.16.9.67.1: from ? before 4.3.33-150400.3.55.2; Container suse/manager/5.0/x8664/proxy-httpd:5.0.5.7.23.1: from ? befor...
CVE-2025-43485
A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a privileged user to retrieve credentials from the log files. HP has addressed the issue in the latest software update...
PCL（Point Cloud Library） 日志信息泄露漏洞
PCL Point Cloud Library is a library of PCL open source. A log information disclosure vulnerability exists in PCL Point Cloud Library versions 2.12.0-beta.5 through 2.12.0-beta.9, which stems from login credentials being logged in a local log file, which could lead to credential disclosure...
PT-2025-30503 · Poly · Poly Clariti Manager
Name of the Vulnerable Software and Affected Versions: Poly Clariti Manager versions prior to 10.12.2 Description: A security issue has been identified in Poly Clariti Manager that may allow a privileged user to retrieve credentials from log files. Recommendations: Update Poly Clariti Manager to...
CVE-2025-6720
The Vchasno Kasa plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clearalllog function in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to clear log files...
PT-2025-30117 · WordPress · Vchasno Kasa
Name of the Vulnerable Software and Affected Versions: Vchasno Kasa plugin for WordPress versions up to and including 1.0.3 Description: The Vchasno Kasa plugin for WordPress is susceptible to unauthorized data loss. This is due to a missing capability check within the clear all log function,...
WordPress plugin Vchasno Kasa 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...
CVE-2025-6391
CVE-2025-6391 affects Brocade ASCG prior to 3.3.0. The issue arises from logging JSON Web Tokens (JWT) in log files, enabling an attacker with log access to withdraw unencrypted tokens, potentially leading to unauthorized access, session hijacking, and information disclosure. Public-coverage in m...
PT-2025-29560 · Dell · Dell Ecs +1
Name of the Vulnerable Software and Affected Versions: Dell ECS versions prior to 3.8.1.5 ObjectScale version 4.0.0.0 Description: Dell ECS versions prior to 3.8.1.5 and ObjectScale version 4.0.0.0 contain a flaw that allows the insertion of sensitive information into log files. A low-privileged...
CVE-2024-47252
A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...
CVE-2024-47252
Insufficient escaping of user-supplied data in modssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to log variables...
CVE-2024-47252
CVE-2024-47252 concerns the Apache HTTP Server’s mod_ssl: in versions up to 2.4.63, insufficient escaping of user-supplied data can allow an untrusted TLS client to insert escape characters into log files in some configurations (notably when CustomLog uses "%{varname}x" or "%{varname}c" to log mo...
PT-2025-28957 · Dell · Dell Powerflex Manager
Name of the Vulnerable Software and Affected Versions: Dell PowerFlex Manager VM versions prior to 4.6.2.1 Description: Dell PowerFlex Manager VM is affected by an issue allowing the insertion of sensitive information into log files. A low-privileged attacker with remote access could exploit this...
CVE-2025-20325
In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the software potentially exposes the search head cluster splunk.secret key. This exposure could happen if you have a Search Head cluster and...
OpenBao Inserts Sensitive Information into Log File when processing malformed data
Impact OpenBao before v2.3.0 and HashiCorp Vault as of the current v1.19.5 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. Patches This issue has been fixed in OpenBao v2.3.0 and later. Workarounds Like with...