Red Hat Keycloak Security Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak version 22.0.5, which stems from a log injection issue that could allow an attacker to inje...

CVE-2023-6002

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

Cross site scripting

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002

YugabyteDB is affected by CVE-2023-6002: a cross-site scripting (XSS) vulnerability via log injection. The issue arises when invalidated user input is written to log files, which can allow an unprivileged attacker to forge log entries or inject malicious content into logs. The provided documents ...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

CVE-2023-6002 Log Injection

YugabyteDB is vulnerable to cross site scripting XSS via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs...

YugabyteDB Cross-Site Scripting Vulnerability

YugabyteDB is a high-performance transactional distributed SQL database for cloud-native applications from Yugabyte, Inc. YugabyteDB suffers from a cross-site scripting vulnerability that stems from the ease of injecting cross-site scripting via logs, where writing invalid user input to a log fil...

PT-2023-7514

Name of the Vulnerable Software and Affected Versions Keycloak version 22.0.5 Description A log injection flaw was found in Keycloak, related to the WebAuthn authentication mode. This issue allows a text string to be injected through the authentication form, which may have a minor impact on the...

SALESmanago < 3.2.5 - Log Injection via Weak Authentication Token

Description The plugin uses a weak authentication toke for it's /wp-json/salesmanago/v1/callbackApiV3 API endpoint, allowing unauthenticated attackers to inject arbitrary content into the plugin logs...

CVE-2023-4939

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page...

CVE-2023-4939

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page...

Authentication flaw

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page...

CVE-2023-4939 SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page...

CVE-2023-4939 SALESmanago <= 3.2.4 - Log Injection via Weak Authentication Token

The SALESmanago plugin for WordPress is vulnerable to Log Injection in versions up to, and including, 3.2.4. This is due to the use of a weak authentication token for the /wp-json/salesmanago/v1/callbackApiV3 API endpoint which is simply a SHA1 hash of the site URL and client ID found in the page...

CVE-2023-4939

The SALESmanago WordPress plugin (

CVE-2023-43667

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.8.0, the attacker can create misleading or false log records, making it harder to audit and trace malicious...

CVE-2023-4571 Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)

In Splunk IT Service Intelligence ITSI versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute ANSI escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them, can run malicious code in the vulnerable...

CVE-2023-3997 Unauthenticated Log Injection In Splunk SOAR

Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk SOAR a maliciously crafted web request containing special ANSI characters to cause log file poisoning. When a terminal user attempts to vi...

SAP NetWeaver AS Java Log Injection (July 2023)

SAP NetWeaver Application Server for Java is affected by a log injection vulnerability. SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a...