Apache Log4j: Multiple Vulnerabilities

Background Log4j is a Java logging framework that supports various use cases with a rich set of components, a separate API, and a performance-optimized implementation. Description Multiple vulnerabilities hav been discovered in Apache Log4j. Please review the CVE identifiers referenced below for...

CVE-2024-21987

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

CVE-2024-21987

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

Spoofing

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

CVE-2024-21987 Improper Authorization Vulnerability in SnapCenter

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

CVE-2024-21987 Improper Authorization Vulnerability in SnapCenter

SnapCenter versions 4.8 prior to 5.0 are susceptible to a vulnerability which could allow an authenticated SnapCenter Server user to modify system logging configuration settings...

CVE-2024-21987

CVE-2024-21987 affects NetApp SnapCenter: versions 4.8 prior to 5.0 are vulnerable due to insufficient authorization, allowing an authenticated SnapCenter Server user to modify the system logging configuration. Documented impact is limited to changing logging settings; no exploit details are prov...

PT-2024-2526 · Netapp · Netapp Snapcenter

Name of the Vulnerable Software and Affected Versions: NetApp SnapCenter versions 4.8 prior to 5.0 Description: The issue is related to insufficient authorization in the NetApp SnapCenter platform, allowing a remote attacker to modify system logging configuration settings. This can be done by an...

PT-2024-1915 · Ibm · Ibm Qradar Suite +1

Name of the Vulnerable Software and Affected Versions: IBM QRadar Suite versions 1.10.12.0 through 1.10.17.0 IBM Cloud Pak for Security versions 1.10.0.0 through 1.10.11.0 Description: The issue is related to insufficient protection of registration data in IBM QRadar Suite and IBM Cloud Pak for...

NetApp SnapCenter Security Vulnerability

NetApp SnapCenter is a suite of applications from Network Appliance NetApp that provides the ability to back up, verify, clone, and restore NetApp storage systems. A security vulnerability exists in NetApp SnapCenter versions 4.8 through prior to 5.0. An attacker could exploit the vulnerability t...

CVE-2024-1367

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host...

Command injection

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host...

CVE-2024-1367 Command Injection Vulnerability in Tenable Security Center

A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging parameters, which could lead to the execution of arbitrary code on the Security Center host...

sudo: Sudo does not escape control characters in log messages

A flaw was found in the sudo package, shipped with Red Hat Enterprise Linux 8 and 9, where sudo improperly escapes terminal control characters during logging operations. As sudo's log messages may contain user-controlled strings, this may allow an attacker to inject terminal control commands,...

sqlite OS Command Injection Vulnerability

SQLite is a lightweight database that is ACID compliant relational database management system. A security vulnerability exists in sqlite. An attacker can exploit the vulnerability to modify logging parameters...

PT-2024-17979 · Tenable · Tenable Security Center

Name of the Vulnerable Software and Affected Versions: Tenable Security Center affected versions not specified Description: A command injection vulnerability exists where an authenticated, remote attacker with administrator privileges on the Security Center application could modify Logging...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

USN-6630-1 python-glance-store vulnerability

It was discovered that Glancestore incorrectly handled logging when the DEBUG log level is enabled. A local attacker could use this issue to obtain accesskey values...

USN-6630-1: Glance_store vulnerability

It was discovered that Glancestore incorrectly handled logging when the DEBUG log level is enabled. A local attacker could use this issue to obtain accesskey values...

SUSE CVE-2023-22649

A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. Rancher Audit Logging is an opt-in feature, only deployments that have it enabled and have AUDITLEVEL set to 1 or above are impacted by this issue...