K70652532: F5 BIG-IP Guided Configuration logging vulnerability CVE-2021-23046

Security Advisory Description When a configuration that contains secure properties is created and deployed from BIG-IP Guided Configuration AGC, secure properties are logged in restnoded logs. CVE-2021-23046 Impact Users with access to restnoded logs may gain access to sensitive information from...

K01049383: BIG-IP restjavad vulnerability CVE-2019-6662

Security Advisory Description Sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data. CVE-2019-6662 Impact When logging invalid requests, such as HTTP co...

K14204: BIND vulnerability CVE-2011-4313

Security Advisory Description ISC reports that query.c in BIND may allow remote attackers to cause a denial-of-service assertion failure and named exit. The vulnerability uses unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver. Th...

K33023560: BIG-IP APM Linux Edge Client logging vulnerability CVE-2020-5908

Security Advisory Description BIG-IP APM Edge Client for Linux exposes the full session ID in the local log files. CVE-2020-5908 Impact This vulnerability may allow unauthorized disclosure of the BIG-IP APM session ID and expose sensitive information to the user of the client device. Security...

K23876153: BIG-IP APM Edge Client logging vulnerability CVE-2019-6656

Security Advisory Description BIG-IP APM Edge Client logs the full BIG-IP APM session ID in the log files. CVE-2019-6656 Impact This vulnerability may allow unauthorized disclosure of the BIG-IP APM session ID and expose sensitive information to the user of the client device. Security Advisory...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

Design/Logic Flaw

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-48308

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-48308

CVE-2022-48308 affects Palantir Sls-logging: the component did not verify hostnames in TLS certificates due to incorrect use of the javax.net.ssl.SSLSocketFactory API. This can enable a network-position attacker to perform a man-in-the-middle attack, intercepting or altering traffic to and from t...

PT-2023-15686

Name of the Vulnerable Software and Affected Versions sls-logging affected versions not specified Description The issue arises from the sls-logging not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. This could allow a malicious attacker in a...

CVE-2022-48308

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

Palantir 信任管理问题漏洞

Palantir is a data platform from Palantir, Inc. that reimagines how people use data by removing the barriers between back-end data management and front-end data analysis. A security vulnerability exists in Palantir Sls-logging prior to version 9.51.0 that originates from an unvalidated hostname i...

CVE-2022-48308: Improper Validation of Certificate with Host Mismatch

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-27890: Improper Validation of Certificate with Host Mismatch

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

CVE-2022-27890

It was discovered that the sls-logging was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack wou...

(RHSA-2023:0633) Moderate: Red Hat OpenShift (Logging Subsystem) security update

Logging Subsystem 5.5.7 - Red Hat OpenShift...

Moderate: Red Hat Security Advisory: Red Hat OpenShift (Logging Subsystem) security update

An update is now available for the Logging subsystem for Red Hat OpenShift 5.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

SUSE CVE-2004-0460

Buffer overflow in the logging capability for the DHCP daemon DHCPD for ISC DHCP 3.0.1rc12 and 3.0.1rc13 allows remote attackers to cause a denial of service server crash and possibly execute arbitrary code via multiple hostname options in 1 DISCOVER, 2 OFFER, 3 REQUEST, 4 ACK, or 5 NAK messages,...