11109 matches found
Yelp: Object Level access control leads to reading user's full requests, sessions, and error messages
The summary is as follows: A vulnerability was discovered in the Yelp internal administration tool called "Tailored Mail" hosted on the subdomain https://proze.yelp.com/. The vulnerability allowed unauthenticated attackers to read the internal admin's full HTTP requests, sessions, and other...
Nextcloud: admin_audit does not log actions on files in a group folder
The adminaudit app in Nextcloud versions prior to 24.0.4 did not log actions on files in a group folder...
MAL-2024-11769 Malicious code in dhp-logging-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware def2cfdcf7555dce8bc6545670a20f1748d6588683a817bc7d922f42c8e9cd43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in dhp-logging-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware def2cfdcf7555dce8bc6545670a20f1748d6588683a817bc7d922f42c8e9cd43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Log Injection
org.apache.nifi, nifi is vulnerable to Log Injection. The vulnerability is due to the optional debug logging feature, which allows an authorized administrator to enable detailed logging of Parameter Context values during flow synchronization...
CVE-2024-55578
Zammad before 6.4.1 places sensitive data such as authmicrosoftoffice365credentials and applicationsecret in log files...
PcVue security vulnerabilities
PcVue is a reliable, secure, and powerful operational software platform from PcVue, Inc. dedicated to monitoring and controlling applications in markets such as building and campus management. A security vulnerability exists in PcVue that stems from user credentials login and password being...
Synology Router Manager security vulnerability
Synology Router Manager SRM is a software used to configure and manage Synology routers from China-based Synology. A security vulnerability exists in Synology Router Manager versions prior to 1.3.1-9346-10, which stems from improper input neutralization in the DDNS logging feature, which is...
MAL-2024-11239 Malicious code in bbb-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 521983fba00c501c41ccbb9e7737eed8be5cff75f427bd2db33daacfdc645e02 The OpenSSF Package Analysis project identified 'bbb-logging' @ 1.0.6 npm as malicious. It is considered malicious because: - The package...
Malicious code in bbb-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 521983fba00c501c41ccbb9e7737eed8be5cff75f427bd2db33daacfdc645e02 The OpenSSF Package Analysis project identified 'bbb-logging' @ 1.0.6 npm as malicious. It is considered malicious because: - The package...
MAL-2024-11233 Malicious code in yelp-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ff40f995641f74640b48eeefb3717de25988026d50ca8f472fe4b69d7a91ca7 The OpenSSF Package Analysis project identified 'yelp-logging' @ 1.0.39 npm as malicious. It is considered malicious because: - The package...
Malicious code in yelp-logging (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ff40f995641f74640b48eeefb3717de25988026d50ca8f472fe4b69d7a91ca7 The OpenSSF Package Analysis project identified 'yelp-logging' @ 1.0.39 npm as malicious. It is considered malicious because: - The package...
CVE-2024-12003
creationtimestamp| type| source ---|---|--- 2024-12-06 09:36:21+00:00| seen| https://infosec.exchange/users/cve/statuses/113605199823333797 2024-12-06 10:35:57+00:00| seen| https://t.me/cvedetector/12184...
openSUSE Security Advisory (SUSE-SU-2024:4194-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Security update for python-python-multipart
This update for python-python-multipart fixes the following issues: CVE-2024-53981: excessive logging for certain inputs when parsing form data. bsc1234115 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...
SUSE-SU-2024:4194-1 Security update for python-python-multipart
This update for python-python-multipart fixes the following issues: - CVE-2024-53981: excessive logging for certain inputs when parsing form data. bsc1234115...
ansible-core: Exposure of Sensitive Information in Ansible Vault Files Due to Improper Logging
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...
Exploit for Uncontrolled Resource Consumption in Ietf Http
CVE-2023-44487 - HTTP/2 Rapid Reset Exploit PoC --- Desc...
Denial of service (DoS) via deformation `multipart/form-data` boundary
Summary When parsing form data, python-multipart skips line breaks CR \r or LF \n in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could...
GHSA-59G5-XGCQ-4QW3 Denial of service (DoS) via deformation `multipart/form-data` boundary
Summary When parsing form data, python-multipart skips line breaks CR \r or LF \n in front of the first boundary and any tailing bytes after the last boundary. This happens one byte at a time and emits a log event each time, which may cause excessive logging for certain inputs. An attacker could...