27128 matches found
Malicious code in proc-log-error (npm)
The package proc-log-error was found to contain malicious code...
MAL-2025-42110 Malicious code in vite-mobcss-log (npm)
The package vite-mobcss-log was found to contain malicious code...
MAL-2025-42058 Malicious code in proc-log-error (npm)
The package proc-log-error was found to contain malicious code...
Malicious code in d360-log (npm)
The package d360-log was found to contain malicious code...
Malicious code in bingo-log (npm)
The package bingo-log was found to contain malicious code...
Malicious code in rtk-log (npm)
The package rtk-log was found to contain malicious code...
MAL-2025-42117 Malicious code in winston-log (npm)
The package winston-log was found to contain malicious code...
MAL-2025-41963 Malicious code in d360-log (npm)
The package d360-log was found to contain malicious code...
MAL-2025-42036 Malicious code in node-log-config (npm)
The package node-log-config was found to contain malicious code...
MAL-2025-42072 Malicious code in rtk-log (npm)
The package rtk-log was found to contain malicious code...
Malicious code in node-log-config (npm)
The package node-log-config was found to contain malicious code...
Malicious code in vite-mobcss-log (npm)
The package vite-mobcss-log was found to contain malicious code...
MAL-2025-41947 Malicious code in bingo-log (npm)
The package bingo-log was found to contain malicious code...
GO-2025-3913 traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ
traQ Allows Insertion of Sensitive Information into Log File in github.com/traPtitech/traQ. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...
Logging user input may result in poisoning logs with ANSI escape sequences
Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modif...
RUSTSEC-2025-0055 Logging user input may result in poisoning logs with ANSI escape sequences
Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to: - Manipulate terminal title bars - Clear screens or modif...
httpd: insufficient escaping of user-supplied data in mod_ssl
A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...
httpd: insufficient escaping of user-supplied data in mod_ssl
A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...
httpd: insufficient escaping of user-supplied data in mod_ssl
A vulnerability was found in the Apache HTTP Server. Insufficient escaping of user-supplied data in modssl allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations. In a logging configuration where CustomLog is used with "%varnamex" or "%varnamec" to...
U.S. Dept Of Defense: Information Disclosure via Publicly Accessible Debug Log
A publicly accessible WordPress debug log file was discovered on the target system. The log file contained PHP warnings and deprecated notices that disclosed sensitive server paths and plugin details. This exposure may have assisted an attacker in fingerprinting the environment or exploiting know...