Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3...

CVE-2023-50844

CVE-2023-50844 is a SQL Injection flaw in the WordPress plugin “Mail logging – WP Mail Catcher,” caused by improper neutralization of input in an SQL command. Affected versions are listed as from n/a through 2.1.3. The vulnerability has been patched; users should update to a fixed release. The ba...

Microsoft Windows PowerShell Code Execution / Event Log Bypass

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WINDOWSPOWERSHELLSINGLEQUOTECODEEXECEVENTLOGBYPASS.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.microsoft.com Product Microsoft Windows PowerShell Built on the...

WordPress Plugin Mail logging SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

CVE-2023-50844: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in James Ward Mail logging – WP Mail Catcher.This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3...

PT-2023-31676

Name of the Vulnerable Software and Affected Versions Mail logging – WP Mail Catcher versions through 2.1.3 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

WordPress Database Cleaner Plugin <= 0.9.8 is vulnerable to Sensitive Data Exposure

Software Database Cleaner Type Plugin Vulnerable versions = 0.9.8 Fixed in 0.9.9 OWASP Top 10 A9: Security Logging and Monitoring Failures Classification Sensitive Data Exposure CVE CVE-2023-51508 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID c44776f4b131 Credits Joshua...

CVE-2023-28616

An issue was discovered in Stormshield Network Security SNS before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends...

Code injection

An issue was discovered in Stormshield Network Security SNS before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends...

CVE-2023-28616: Cleartext Transmission of Sensitive Information

An issue was discovered in Stormshield Network Security SNS before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends...

Zabbix universal monitoring system Buffer Overflow DoS

The vulnerability of the Zabbix universal monitoring system is related to logging beyond buffer boundaries. Exploiting this vulnerability could allow a malicious actor, operating remotely, to cause service failures...

Stormshield Network Security Security Vulnerabilities

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from Stormshield France. A security vulnerability exists in Stormshield Network Security SNS versions prior to 4.3.17, prior to 4.6.4, and prior to 4.7.1, which originates when the serverd process logs...

PT-2023-21849 · Stormshield · Stormshield Network Security

Name of the Vulnerable Software and Affected Versions: Stormshield Network Security SNS versions 4.3.x through 4.3.16 Stormshield Network Security SNS versions 4.4.x through 4.6.x before 4.6.4 Stormshield Network Security SNS versions 4.7.x before 4.7.1 Description: The issue affects user account...

Information disclosure

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-51704

An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group--member messages can result in XSS on Special:log/rights...

CVE-2023-51704: Improper Neutralization of Input During Web Page Generation

An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group--member messages can result in XSS on Special:log/rights...

CVE-2023-51390

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in t...

Code injection

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in t...

CVE-2023-51390

CVE-2023-51390 relates to the journalpump daemon, where a logging issue causes the configuration of a service integration (including credentials, if present) to be logged in plaintext to the configured logging pipeline. The flaw allows exposure of sensitive configuration data due to verbose loggi...