AWS VDP: Non-Production API Endpoints for the DocumentDB Elastic Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The DocumentDB Elastic service was found to have three non-production API endpoints that could be accessed using standard IAM credentials without logging to CloudTrail. This allowed for silent permission enumeration, where an adversary could determine the permissions of compromised credentials...

CVE-2024-49355

IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature...

SUSE-SU-2025:0611-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to overwrite other sensitive files in a system. bsc1236560...

Exploit for Missing Authentication for Critical Function in Paloaltonetworks Pan-Os

CVE-2025-0108 - PAN-OS PoC SCRIPT /!\ Disclaimer: This...

CVE-2025-1075 LDAP credentials logged to Apache error log

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p27, 2.2.0p40, and 2.1.0p51 EOL causes LDAP credentials to be written to Apache error log file accessible to administrators...

CVE-2024-57056

Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could be used by a malicious attacker to impersonate an existing user session...

Komtera KLog Server 路径遍历漏洞

Komtera KLog Server is a logging solution from Komtera. A path traversal vulnerability exists in Komtera KLog Server versions prior to 3.1.1, which stems from improperly restricting directory pathnames when processing web input to file system calls...

CVE-2025-1335

creationtimestamp| type| source ---|---|--- 2025-02-16 04:05:28+00:00| seen| https://infosec.exchange/users/cve/statuses/114011585123849118 2025-02-16 04:15:39+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3libeojv26j2h 2025-02-16 05:11:30+00:00|...

CVE-2024-13513

The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's...

CVE-2024-13513

CVE-2024-13513 affects the Oliver POS – a WooCommerce WordPress plugin, with Sensitive Information Exposure via the plugin’s logging functionality in versions up to 2.4.2.3. Unauthenticated attackers could extract sensitive data (e.g., clientToken) from logs, enabling changes to user account info...

CVE-2024-13513 Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation

The Oliver POS – A WooCommerce Point of Sale POS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.2.3 via the logging functionality. This makes it possible for unauthenticated attackers to extract sensitive data including the plugin's...

CVE-2023-50740

In Apache Linkis =1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0...

CVE-2025-26495

Cleartext Storage of Sensitive Information vulnerability in Salesforce Tableau Server can record the Personal Access Token PAT into logging repositories.This issue affects Tableau Server: before 2022.1.3, before 2021.4.8, before 2021.3.13, before 2021.2.14, before 2021.1.16, before 2020.4.19...

CVE-2024-10404

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

Broadcom SANnav 安全漏洞

Broadcom SANnav is a suite of SAN management platforms from Broadcom Corporation USA. A security vulnerability exists in Broadcom SANnav that stems from CalInvocationHandler logging sensitive information in plaintext. An authenticated, local attacker could use this vulnerability to view sensitive...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.8.17

Logging for Red Hat OpenShift - 5.8.17 Logging for Red Hat OpenShift - 5.8.17 cluster-logging-operator-container: Info Leak via Uninitialized Stack Contents openshift-logging-5.8...

Important: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.11

Logging for Red Hat OpenShift - 5.9.11 Logging for Red Hat OpenShift - 5.9.11 logging-fluentd-container: HTTP request smuggling CVE-2024-47220 cluster-logging-operator-container: Info Leak via Uninitialized Stack Contents CVE-2024-12085...

CVE-2025-25184

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...

CVE-2025-25184 Possible Log Injection in Rack::CommonLogger

Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplied proof-of-concept demonstrates injecting malicious conten...