9990 matches found
UBUNTU-CVE-2026-18710
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...
CVE-2026-18710
CVE-2026-18710 affects a MongoDB driver component. It could write sensitive configuration data, including an outbound-connection credential, to application logs in cleartext during normal client initialization. This requires log access to recover the credential. The impact is limited to confident...
CVE-2026-18710 Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...
Cleartext Storage of Sensitive Information in MongoDB Driver Logging During Client Initialization
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...
EUVD-2026-57016
A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special...
CVE-2026-71845
A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...
CVE-2026-71474 Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could...
EUVD-2026-56898
A flaw was found in insights-client. The setDefault function logs the value of every environment variable it processes, including CCXTOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod...
CVE-2026-71845
A flaw in insights-client causes the setDefault() function to log the value of every environment variable it processes, including CCX_TOKEN , a bearer credential used in disconnected cluster deployments . When glog verbosity is set to level 2 or higher, the token is written in clear text to the p...
CVE-2026-18702
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-18702
Summary: MongoDB Server contains a flaw where an authenticated user with limited, database-scoped privileges can modify diagnostic logging settings that affect the entire server, potentially suppressing monitoring or causing excessive logs. Affected component: diagnostic logging/profile command. ...
EUVD-2026-56918
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-18702
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-18702 Improper Authorization in MongoDB profile Command Allows Unauthorized Modification of Server-Wide Diagnostic Settings
An issue in MongoDB Server could allow an authenticated user with limited, database-scoped privileges to modify diagnostic logging settings that affect the entire server rather than just the intended database. This could allow suppression of diagnostic logging server-wide, potentially obscuring...
CVE-2026-61347
Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally...