CVE-2024-39353 RemoteClusterFrame payloads are audit logged in full

Mattermost versions 9.5.x = 9.5.5 and 9.8.0 fail to sanitize the RemoteClusterFrame payloads before audit logging them which allows a high privileged attacker with access to the audit logs to read message contents...

CVE-2024-24791 vulnerabilities

Vulnerabilities for packages: extism, smarter-device-manager-fips, wuzz, aws-load-balancer-controller-fips, yam, dynamic-localpv-provisioner, nri-f5, wait-for-port, aws-flb-kinesis, influx, chartmuseum, fulcio, nats, aws-efs-csi-driver-fips, tkn-fips, cloudnative-pg, mkcert,...

Indian Software Firm's Products Hacked to Spread Data-Stealing Malware

Installers for three different software products developed by an Indian company named Conceptworld have been trojanized to distribute information-stealing malware. The installers correspond to Notezilla, RecentX, and Copywhiz, according to cybersecurity firm Rapid7, which discovered the supply...

GO-2024-2530 Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd

Etcd auth Inaccurate logging of authentication attempts for users with CN-based auth only in go.etcd.io/etcd...

PT-2024-28052 · Unknown · Nlohmann/Json +1

Name of the Vulnerable Software and Affected Versions: dd-trace-cpp versions prior to 0.2.2 Description: The issue occurs when the library fails to extract trace context due to malformed unicode. It attempts to log the list of audited headers and their values using the nlohmann JSON library...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

CVE-2024-22276

VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjacent access to web/proxy server logging may be able to obtain sensitive information from URLs that are logged...

CVE-2024-22276: Insertion of Sensitive Information into Log File

VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjacent access to web/proxy server logging may be able to obtain sensitive information from URLs that are logged...

CVE-2024-36072: Logging of Excessive Data

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector (versions 5.9.3 and earlier) and CoSoSys Unify (versions 7.0.6 and earlier) are vulnerable to a remote code execution vulnerability. The flaw exists within the logging component of the server application, where an unauthenticated remote attacker can send a malic...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

CVE-2024-36072

Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the logging component of the Endpoint Protector and Unify server application which allows an unauthenticated remote attacker to send a malicious request, resulting in...

Information Disclosure

typo3/cms is vulnerable to Information Disclosure. The vulnerability is due to logging login failures, including plain-text user credentials, at the "warning" log level, which potentially leads to unauthorized access to sensitive user information...

Exposure of secrets through system log in structs

structs provides utility functionality used, e.g., in Pipeline to instantiate and configure build steps, typically before their execution. When structs 337.v1b04ea4df7c8 and earlier fails to configure a build step, it logs a warning message containing diagnostic information that may contain secre...

MAL-2024-6899 Malicious code in fluent_plugin-airbrake-logger (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregіsters.AspNetCore.Mvc.Logging (NuGet)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-4223 Malicious code in Be.Vlaaոderen.Basisregіsters.AspNetCore.Mvc.Logging (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Be.Vlaaոderen.Basisregіstеrs.AspNetCore.Mvc.Lоgging (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-6104

A vulnerability was found in go-retryablehttp. The package may suffer from a lack of input sanitization by not cleaning up URL data when writing to the logs. This issue could expose sensitive authentication information. Mitigation Mitigation for this issue is either not available or the currently...

AZL-42880 CVE-2024-6104 affecting package cert-manager for versions less than 1.12.12-3

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...