10713 matches found
PT-2025-37039
Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One / AxxonNet versions 2.0.4 and earlier Description: The ARP Agent component in AxxonSoft Axxon One / AxxonNet contains a flaw where sensitive information is inserted into log files. A local attacker can obtain plaintext...
Linux Distros Unpatched Vulnerability : CVE-2023-45158
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging not the default...
Linux Distros Unpatched Vulnerability : CVE-2025-6711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered...
Linux Distros Unpatched Vulnerability : CVE-2020-13881
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In support.c in pamtacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. CVE-2020-13881 Not...
Aspect-Oriented Programming in Secure Software Development: a Case Study of Security Aspects in Web Applications
Security remains a critical challenge in modern web applications, where threats such as unauthorized access, data breaches, and injection attacks continue to undermine trust and reliability. Traditional Object-Oriented Programming OOP often intertwines security logic with business functionality,...
django-automated-logging (0.0.1a0) potentially affected by CVE-2025-57833 via django (1.10.0rc1)
django PYPI version 1.10.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-automated-logging 0.0.1a0 Source cves: CVE-2025-57833 Source advisory: OSV:GHSA-6W2R-R2M5-XQ5W...
GO-2025-3920 Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast
Contrast leaks workload secrets to logs on INFO level in github.com/edgelesssys/contrast...
ebram_web_scanner
EBRAM Web Scanner EBRAM Web Scanner is a powerful Python-ba...
Exploit for Deserialization of Untrusted Data in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
PoC exploit for CVE-2021-44228, a Java logging library vulnerability. The target product/service is Apache Log4j, a Java logging library. The vulnerability class/vector is RCE Remote Code Execution via JNDI Java Naming and Directory Interface lookup. The probable entry points are JNDI lookups...
log4jScanner
This is a tool for scanning internal subnets for vulnerable log4j web services. It sends a JNDI payload to each discovered web service on common HTTP/S ports and logs the responding host IP. The tool does not send any exploits to the vulnerable hosts and is designed to be as passive as possible...
OESA-2025-2170 httpd security update
Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: HTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP respons...
Sensitive Information Disclosure
@backstage/plugin-scaffolder-backend is vulnerable to Sensitive Information Disclosure. The vulnerability is due to duplicate logging of input values in the fetch:template action, which could expose sensitive data if $ secrets.x is used as an argument...
ROS-20250905-01
A vulnerability in the Python library responsible for interacting with various image storage backends python-glance-store is related to the fact that the package registers an accesskey for Glance-store when the DEBUG log level is enabled. DEBUG log level. Exploitation of the vulnerability could...
Malicious Package
Overview logging-winston is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malware in logging-winston
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in logging-winston (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0433a58c0d2019ba753b2ac69bc12319ce704bc3fcf7ff537ccea2164e1e8f31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-42145 Malicious code in logging-winston (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0433a58c0d2019ba753b2ac69bc12319ce704bc3fcf7ff537ccea2164e1e8f31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
...
Improper Neutralization
Active Record is vulnerable to Improper Neutralization. The vulnerability is due to unescaped ANSI sequences being logged when IDs are passed to find or similar methods...