CVE-2025-37727 Elasticsearch Insertion of sensitive information in log file

Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex...

CVE-2025-37727

CVE-2025-37727 affects Elasticsearch. The vulnerability involves insertion of sensitive information into log files when auditing requests to the reindex API, potentially leading to confidentiality loss under specific preconditions. The CVSS 3.1 score is 5.7 (Medium) with attack vector Adjacent, c...

CVE-2025-44823

Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/getusers call. This is GL:NLS475...

Elasticsearch 7.0.x <= 7.17.29 / 8.0.x < 8.18.8 / 8.19.x < 8.19.5 / 9.0.x < 9.0.8 / 9.1.x < 9.1.5 (ESA-2025-18)

The version of Elasticsearch installed on the remote host is prior to 8.18.8, 8.19.5, 9.0.8, or 9.1.5. It is, therefore, affected by a vulnerability as referenced in the ESA-2025-18 advisory. - Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality und...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

CVE-2025-55321 Azure Monitor Log Analytics Spoofing Vulnerability

...

EUVD-2025-33368

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's...

CVE-2025-59998

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's...

CVE-2025-59998

An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Archive Log screen that, when visited by another user, enables the attacker to execute commands with the target's...

CLSA-2025-1760025490 cloud-init: Fix of CVE-2023-1786

CVE-2023-1786: fix leak of sensitive user/vendor data and enforce 640 perms on cloud-init.log...

Azure Monitor Log Analytics Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Monitor allows an unauthorized attacker to perform spoofing over a network...

Security Bulletin: IBM Maximo Application Suite - Monitor Component is vulnerable to Django-4.2.20-py3-none-any.whl CVE-2025-48432

Summary IBM Maximo Application Suite - Monitor Component is vulnerable to Django-4.2.20-py3-none-any.whl CVE-2025-48432. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2025-48432 DESCRIPTION: An issue was discovered in Django 5.2 before...

CVE-2025-11462

Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator user to create a...

CVE-2025-27040

Information disclosure may occur while processing the hypervisor log...

CVE-2025-27040

CVE-2025-27040 affects Qualcomm TZ Firmware in chipsets; root cause is improper input validation when processing hypervisor logs, leading to information disclosure (confidentiality impact). Reported across Red Hat/NVD/CVE listings with no confirmed exploit details. Some sources note no public fix...

EUVD-2025-33243

Information disclosure may occur while processing the hypervisor log...

CVE-2025-27040 Improper Input Validation in TZ Firmware

Information disclosure may occur while processing the hypervisor log...

CVE-2025-27040 Improper Input Validation in TZ Firmware

Information disclosure may occur while processing the hypervisor log...

PT-2025-41434

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation issue exists in Juniper Networks Junos Space. This allows an attacker to inject script tags in the Archive Log...

KLA89197 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Entra ID can be exploited remotely to gain privilege...