Fedora 40 : php (2024-2b429e720e)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2b429e720e advisory. PHP version 8.3.12 26 Sep 2024 CGI: Fixed bug GHSA-p99j-rfp4-xqvq Bypass of CVE-2024-4577, Parameter Injection Vulnerability. CVE-2024-8926 nielsdos...

Cisco Nexus Dashboard 安全漏洞

Cisco Nexus Dashboard is a single console from Cisco, Inc. It can simplify the operation and management of data center networks. A security vulnerability exists in Cisco Nexus Dashboard that originates when remote controller credentials are recorded in internal logs stored in technical support...

Cisco Nexus Dashboard 安全漏洞

Cisco Nexus Dashboard is a single console from Cisco, Inc. It can simplify the operation and management of data center networks. A security vulnerability exists in Cisco Nexus Dashboard that stems from the possibility that HTTP proxy credentials could be recorded in internal logs stored in...

Synology Drive 日志信息泄露漏洞

Synology Drive is a collaborative office suite from China-based Synology Inc. The product includes document management, collaborative office and file synchronization and backup features. A log information disclosure vulnerability exists in Synology Drive versions prior to 3.3.0-15082, which stems...

php -- Multiple vulnerabilities

php.net reports: CVE-2024-8926: CGI: Fixed bug GHSA-9pqp-7h25-4f32 Bypass of CVE-2024-4577, Parameter Injection Vulnerability. CVE-2024-8927: CGI: Fixed bug GHSA-94p6-54jq-9mwp cgi.forceredirect configuration is bypassable due to the environment variable collision. CVE-2024-9026: FPM: Fixed bug...

PT-2024-27936 · Advantech · Advantech Adam 5550

Name of the Vulnerable Software and Affected Versions: Advantech ADAM 5550 affected versions not specified Description: The device's web application includes a "logs" page where all HTTP requests received are displayed to the user. However, it fails to correctly neutralize malicious code when...

PT-2024-13336 · Ibm · Ibm Cloud Pak For Multicloud Management

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management versions 2.3 through 2.3 FP8 Description: The issue concerns the storage of user credentials in log files in plain clear text, which can be accessed by a privileged user. This results in the exposure of...

CVE-2024-47083

CVE-2024-47083 affects the Microsoft Power Platform Terraform Provider. Versions prior to 3.0.0 contain an issue where the service principal authentication’s sensitive data, notably the client_secret, may be exposed in logs due to a logging code error that fails to mask it when logs are persisted...

CVE-2024-47083 Power Platform Terraform Provider has Improper Masking of Secrets in Logs

Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the clientsecret used in the service principal authentication, may be...

CVE-2024-7421

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions...

CVE-2024-7421

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions...

CVE-2024-7421

An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain session credentials via passwords included in command-line arguments when launching WinSCP sessions...

CVE-2024-7421

The vulnerability CVE-2024-7421 affects Devolutions Remote Desktop Manager (versions up to 2024.2.20.0) on Windows. The issue is an information exposure where credentials used for WinSCP sessions can be retrieved by local attackers who can access system logs, via passwords found in command-line a...

Microsoft Power Platform Terraform Provider 安全漏洞

Microsoft Power Platform Terraform Provider is a power platform provider from Microsoft Corporation USA. A security vulnerability exists in Microsoft Power Platform Terraform Provider versions prior to 3.0.0 that stems from an error in the logging code that prevents sensitive records from being...

The vulnerability of HashiCorp’s Vault and Vault Enterprise file archiving platforms lies in the fact that inserting confidential information into the log file allows a perpetrator to access this confidential information.

The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms lies in the fact that open text values for client tokens and token accessories are stored in an audit log. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

CVE-2024-45808

A flaw was found in envoy. Affected versions of envoy may allow malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access loggers. Mitigation Mitigation for this issue is either not availab...

CVE-2024-45808 Malicious log injection via access logs in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access logger...

CVE-2024-45808

CVE-2024-45808 affects the Envoy proxy and stems from insufficient validation of the REQUESTED_SERVER_NAME in access loggers, enabling potential log content manipulation. Affected versions are 1.31.2, 1.30.6, 1.29.9, and 1.28.7; upgrade to the fixed releases to remediate. The connected sources co...

CVE-2024-45808 Malicious log injection via access logs in envoy

Envoy is a cloud-native high-performance edge/middle/service proxy. A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content into access logs. This is achieved by exploiting the lack of validation for the REQUESTEDSERVERNAME field for access logger...

PT-2024-31788

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.28.7 Envoy versions prior to 1.29.9 Envoy versions prior to 1.30.6 Envoy versions prior to 1.31.2 Description: A vulnerability has been identified in Envoy that allows malicious attackers to inject unexpected content...