EUVD-2017-13013

Malware in sbrugna...

PT-2025-35709

Name of the Vulnerable Software and Affected Versions: versions not specified Description: Users with webhook permissions can conduct Server-Side Request Forgery SSRF via webhooks. If they have permission to view the webhook logs, the partial request response is also disclosed. This allows...

CVE-2015-7237

Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent MA 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors...

PT-2024-17383 · Crushftp · Crushftp

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves improper input handling in the 'Host Header', allowing an unauthenticated attacker to store a payload in web application logs. When a...

CVE-2024-33860

Logpoint versions prior to 7.4.0 are vulnerable to Local File Inclusion (LFI) . This issue occurs when an arbitrary File Path is used within the File System Collector , allowing an attacker to view the content of the specified file within the incoming logs. To resolve this, it is recommended to u...

POST SMTP Mailer < 2.8.8 - Authorization Bypass via type connect-app API

Description The plugin is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7. This makes it possible for unauthenticated attackers to reset the API key used to authenticate to...

CVE-2023-38065

CVE-2023-38065 concerns JetBrains TeamCity before 2023.05.1, where a stored XSS vulnerability exists when viewing the build log. Sources (CNVD, Red Hat, Nessus and others) describe the issue as caused by incorrect validation of user-supplied input in the build log and confirm the vulnerability is...

CVE-2023-31437

An issue was discovered in systemd 253. An attacker can modify a sealed log file such that, in some views, not all existing and sealed log messages are displayed. NOTE: the vendor reportedly sent "a reply denying that any of the finding was a security vulnerability."...

Privilege escalation

An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation...

SAUTER EY-modulo 5 Building Automation Station 跨站脚本漏洞

SAUTER EY-modulo 5 Building Automation Station is a complete building management solution from SAUTER. A security vulnerability exists in SAUTER EY-modulo 5 Building Automation Station. An attacker can exploit the vulnerability to force all authenticated users to perform unauthorized actions by...

CVE-2023-25825 ZoneMinder contains Cross-site Scripting via log viewing

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This i...

CVE-2023-25825 ZoneMinder contains Cross-site Scripting via log viewing

ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33 are vulnerable to Cross-site Scripting. Log entries can be injected into the database logs, containing a malicious referrer field. This i...

PT-2022-9465

Name of the Vulnerable Software and Affected Versions Download Monitor WordPress plugin versions prior to 4.4.5 Description The issue arises from the improper validation and escaping of the orderby GET parameter in SQL statements when viewing logs, leading to an SQL Injection issue. Recommendatio...

Lukashinsch Spring Boot Actuator Logview Path Traversal Vulnerability

Lukashinsch Spring Boot Actuator Logview is a codebase by the individual developer Ffay Lukashinsch that provides Spring Boot with the ability to view logs via a web interface. A path traversal vulnerability exists in spring-boot-actuator-logview versions prior to 0.2.13, which stems from the...

PT-2020-13386 · Cacti +3 · Cacti +3

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.11 Description: The issue arises when a user account is disabled in Cacti, but the permissions granted to that account are not immediately invalidated. This means that the disabled account may still have access to...

CVE-2018-13375

An Improper Neutralization of Script-Related HTML Tags in Fortinet FortiAnalyzer 5.6.0 and below and FortiManager 5.6.0 and below allows an attacker to send DHCP request containing malicious scripts in the HOSTNAME parameter. The malicious script code is executed while viewing the logs in...

Arbitrary File Read

redhat-access-plugin-openstack is vulnerable to arbitrary file read. The vulnerability exists as the log-viewing function in the Red Hat redhat-access-plugin before 6.0.3 for OpenStack Dashboard horizon allows remote attackers to read arbitrary files via a crafted path...

CVE-2019-6267

The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI...

CVE-2019-6267

The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI...

CVE-2017-17098

The writeLog function in fncommon.php in gps-server.net GPS Tracking Software self hosted through 3.0 allows remote attackers to inject arbitrary PHP code via a crafted request that is mishandled during admin log viewing, as demonstrated by in a login request...