Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the fact that socpcmret should not be used in the .prepare callback, which could lead to error logging...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Ansible vulnerabilities (USN-7330-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7330-1 advisory. It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker could possib...

Envoy Gateway 安全漏洞

Envoy Gateway is an Envoy Proxy open source that uses the Envoy proxy as a gateway for standalone or Kubernetes-based applications. A security vulnerability exists in Envoy Gateway versions prior to 1.2.7 and 1.3.1 that stems from the default Envoy Proxy access logging configuration being...

USN-7330-1 ansible vulnerabilities

It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker could possibly use this issue to spoof SSL servers if they were able to intercept network communications. This issue only affected Ubuntu 14.04 LTS. CVE-2015-3908 Martin Carpenter discovered...

Moderate: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.8.18

Logging for Red Hat OpenShift - 5.8.18 Logging for Red Hat OpenShift - 5.8.18 logging-kibana6-container: Untrusted code execution via tag in HTML passed to DOM manipulation methods CVE-2020-11023...

Moderate: Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.12

Logging for Red Hat OpenShift - 5.9.12 Logging for Red Hat OpenShift - 5.9.12 logging-fluentd-container: Possible Log Injection in Rack::CommonLogger openshift-logging-5.9...

Vasion Print 安全漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. Vasion Print has a security vulnerability that stems from an insecure logging permission configuration...

Linux Distros Unpatched Vulnerability : CVE-2022-39289

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user...

Linux Distros Unpatched Vulnerability : CVE-2024-40954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after- free by: attaching an fentry probe to sockrelease and...

Linux Distros Unpatched Vulnerability : CVE-2022-3594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intrcallback of the file...

AWS VDP: Non-Production API Endpoints for the Forecast Service Fail to Log to CloudTrail Resulting in Silent Permission Enumeration

The Forecast service in Amazon Web Services AWS has four non-production API endpoints that can be accessed using standard IAM credentials, but do not log any activity to CloudTrail. This allows for silent permission enumeration, where an adversary can test the capabilities of compromised...

AWS VDP: Non-Production API Endpoint for the ElastiCache Service Fails to Log to CloudTrail Resulting in Silent Permission Enumeration

The ElastiCache service contains a non-production API endpoint that allows for permission enumeration without logging to CloudTrail. This could enable an adversary with compromised credentials to silently test the permissions of the credentials...

Linux Distros Unpatched Vulnerability : CVE-2010-2387

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - vicious-extensions/ve-misc.c in GNOME Display Manager gdm 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8...

CVE-2025-23405

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in cli workflow. Confidential information such as s3secretaccesskey is cached in shell history. Remediation Upgrade github.com/kuzudb/go-kuzu to version 0.8.2 or higher. References - GitH...

CVE-2025-22271

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271

CVE-2025-22271 affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The issue allows an attacker to spoof the client’s IP by supplying a value in the X-Forwarded-For header, which degrades accountability of action logging in the application. Other versions are listed as unknown. Pu...

PT-2025-9090 · Cyberark · Cyberark Endpoint Privilege Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 Description: The issue allows IP address spoofing by providing a custom value in the X-Forwarded-For header, which compromises the action logging mechanism's accountability...