CVE-2023-51390

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in t...

Code injection

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in t...

CVE-2023-51390 Information Disclosure Vulnerability in Journalpump

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in t...

CVE-2023-51390

CVE-2023-51390 relates to the journalpump daemon, where a logging issue causes the configuration of a service integration (including credentials, if present) to be logged in plaintext to the configured logging pipeline. The flaw allows exposure of sensitive configuration data due to verbose loggi...

journalpump Information Disclosure Vulnerability

journalpump is an Aiven open source daemon that fetches log messages from Journald and pumps them to a given output. An information disclosure vulnerability exists in Journalpump versions prior to 2.5.0, which stems from logging the configuration of a service integration into the provided logging...

PT-2023-31804 · Unknown · Journalpump

Name of the Vulnerable Software and Affected Versions: journalpump versions prior to 2.5.0 Description: A logging issue was found in journalpump, where it logs the configuration of a service integration in plaintext to the supplied logging pipeline. This includes credential information contained ...

Azure Serial Console Attack and Defense - Part 2

This is the second installment of the Azure Serial Console blog, which provides insights to improve defenders’ preparedness when investigating Azure Serial Console activity on Azure Linux virtual machines. While the first blog post discussed various tracing activities, such as using Azure activit...

PT-2023-31410 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 7.17.16 Elasticsearch versions prior to 8.11.2 Description: An issue was discovered whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of documents...

Information Disclosure

org.owasp/dependency-check is vulnerable to Information Disclosure. The vulnerability is due to the nvdApiKey not being masked because it doesn't match the specified patterns. As a result, when debug mode is enabled using mvn -X, the API key is logged in clear text. This exposes the NVD API key...

nvdApiKey is logged in debug mode

Summary The value of nvdApiKey configuration parameter is logged in clear text in debug mode. Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print Note that...

Asterisk Multiple Vulnerabilities (Dec 2023)

Asterisk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if description...

CVE-2023-1904

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...

CVE-2023-1904

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...

CVE-2023-1904

CVE-2023-1904 affects Octopus Server. The issue allows the OpenID client secret to be logged in clear text during server configuration. Public records in the provided documents confirm the vulnerability and its association with Octopus Server, but do not specify an official fix or affected versio...

SUSE CVE-2023-46675

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Accou...

PT-2023-17328 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows the OpenID client secret to be logged in clear text during the configuration of the server. Recommendations: At the moment, there is no information about a newer...

Low: Red Hat Security Advisory: Logging Subsystem 5.8.1- Red Hat OpenShift security update

An update is now available for RHOL-5.8-RHEL-9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the Reference...

Authorization

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logging is enabled in Kibana. Elastic has released Kibana 8.11.2 which resolves this issue. The messages recorded in the log may contain Accou...

Code injection

An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 which resolves this issue. The error message recorded in the log may contain account credentials for the kibanasystem user, API Keys, and...

CVE-2023-46675

CVE-2023-46675 affects Elastic Kibana and describes an information-disclosure risk where sensitive data may be written to Kibana logs during errors or when debug logging is enabled. Affected ranges include Kibana 7.13.0–7.17.16 and 8.0.0–8.11.1. Log entries could contain credentials for kibana_sy...