ABB Cylon FLXeon 9.3.4 cert.js System Logs Information Disclosure Vulnerability

ABB Cylon FLXeon version 9.3.4 has an issue where an authenticated attacker can access sensitive information via the system logs page of ABB Cylon FLXeon controllers. The logs expose critical data, including the OpenSSL password for stored certificates. This information can be leveraged for furth...

CVE-2023-43846

Incorrect access control in logs management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote attackers to get the device logs via HTTP GET request. The logs contain such information as user names and IP addresses used in the infrastructure. This information may help the...

CVE-2025-1094

A flaw was found in PostgreSQL. Due to improper neutralization of quoting syntax, affected versions potentially allow a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the affected function's result to constru...

SUSE CVE-2023-30601

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

SUSE CVE-2024-41178

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

CVE-2024-10404

CalInvocationHandler in Brocade SANnav before 2.3.1b logs sensitive information in clear text. The vulnerability could allow an authenticated, local attacker to view Brocade Fabric OS switch sensitive information in clear text. An attacker with administrative privileges could retrieve sensitive...

CVE-2025-1053 Brocade SANnav encryption key is logged in the debug logs

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

CVE-2025-1053 Brocade SANnav encryption key is logged in the debug logs

Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Brocade SANna...

CVE-2025-22960

A session hijacking vulnerability exists in the web-based management interface of GatesAir Maxiva UAXT, VAXT transmitters. Unauthenticated attackers can access exposed log files /logs/debug/xteLog, potentially revealing sensitive session-related information such as session IDs sessid and...

Security update for unbound

This update for unbound fixes the following issues: Update to 1.22.0: Features: Add iter-scrub-ns, iter-scrub-cname and max-global-quota configuration options. Merge patch to fix for glue that is outside of zone, with harden-unverified-glue, from Karthik Umashankar Microsoft. Enabling this option...

PT-2025-6969 · Gatesair · Gatesair Maxiva Vaxt

Name of the Vulnerable Software and Affected Versions: GatesAir Maxiva UAXT, VAXT transmitters affected versions not specified Description: A session hijacking issue exists in the web-based management interface, allowing unauthenticated attackers to access exposed log files at "/logs/debug/xteLog...

CVE-2025-22960

The CVE-2025-22960 issue affects GatesAir Maxiva UAXT/VAXT transmitters, where the web-based management interface exposes log files at /logs/debug/xteLog* that can reveal session-related data (sess_id, user_check_password OK). Unauthenticated attackers could hijack active sessions and gain unauth...

ABB Cylon FLXeon 9.3.4 cert.js System Logs Information Disclosure

ABB Cylon FLXeon version 9.3.4 has an issue where an authenticated attacker can access sensitive information via the system logs page of ABB Cylon FLXeon controllers. The logs expose critical data, including the OpenSSL password for stored certificates. This information can be leveraged for furth...

Brocade SANnav encryption key is logged in the debug logs (CVE-2025-1053)

Under certain error conditions at time of Brocade SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use the encryption key to obtain passwords used by Broca...

ABB Cylon FLXeon 9.3.4 (cert.js) System Logs Information Disclosure

Summary BACnet® Smart Building Controllers. ABB's BACnet portfolio features a series of BACnet® IP and BACnet MS/TP field controllers for ASPECT® and INTEGRA™ building management solutions. ABB BACnet controllers are designed for intelligent control of HVAC equipment such as central plant, boiler...

CVE-2025-21690

In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU utilization, preventing troubleshooti...

Astra Linux – Vulnerability in OpenVPN

Before version 2.6.11, OpenVPN did not properly sanitize PUSHREPLY messages. This vulnerability could be exploited by attackers who control the server, allowing them to inject unexpected arbitrary data into client logs...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Nilfs2: Fixed missing cleanup operations during rollforward recovery processes. During an error injection test of a routine for mount-time recovery, KASAN identified a use-after-free bug. It turned out that if data recovery wa...

The vulnerability of VMware Aria Operations for Logs, a tool for analyzing network logs, stems from the lack of security measures taken to protect the website structure. This vulnerability allows attackers to inject and execute arbitrary code in users’ browsers, within the context of the vulnerable website.

The vulnerability of the VMware Aria Operations for Logs network log analysis tool exists due to the lack of security measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject and execute arbitrary code into the user’s browser context throug...

PT-2025-6264 · Fortinet · Fortianalyzer

Name of the Vulnerable Software and Affected Versions: Fortinet FortiAnalyzer versions 6.4.0 through 7.6.0 Description: The issue allows an unauthorized actor to cause information disclosure via filter manipulation, potentially leading to the exposure of sensitive information. This is related to...