9724 matches found
Malicious code in aws-logs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4707229414d50f1284c7a7b64169463a7c7ca779faf42df6b059947dfd1b79eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2024-26616 · Unknown · Bowo Debug Log Manager
Name of the Vulnerable Software and Affected Versions: Bowo Debug Log Manager versions 2.3.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Bowo Debug Log Manager. This vulnerability exposes unprotected logs. Recommendations: For versions 2.3.1 and...
GHSA-H6M6-JJ8V-94JJ SQL injection in litellm
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...
CVE-2024-3149
A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...
CVE-2024-3149 SSRF in mintplex-labs/anything-llm
A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...
CVE-2024-3149 SSRF in mintplex-labs/anything-llm
A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...
CVE-2024-3149 SSRF in mintplex-labs/anything-llm
A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by...
CVE-2024-5225 SQL Injection in berriai/litellm
An SQL Injection vulnerability exists in the berriai/litellm repository, specifically within the /global/spend/logs endpoint. The vulnerability arises due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an unvalidat...
CVE-2024-5225
The CVE-2024-5225 issue affects litellm (LiteLLM) / berriai/litellm, specifically the /global/spend/logs endpoint, where the code builds an SQL query by directly concatenating an unvalidated api_key parameter. This SQL Injection vulnerability can lead to unauthorized access, data manipulation, ex...
santuario: Private Key disclosure in debug-log output
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...
CVE-2024-0912
Under certain circumstances the Microsoft® Internet Information Server IIS used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions...
PT-2024-35137
Name of the Vulnerable Software and Affected Versions berriai/litellm repository affected versions not specified Description An SQL Injection issue exists due to improper neutralization of special elements used in an SQL command. The affected code constructs an SQL query by concatenating an...
CVE-2024-25095
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0...
GO-2024-2861 azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver
azure-file-csi-driver leaks service account tokens in the logs in sigs.k8s.io/azurefile-csi-driver...
GO-2024-2859 source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller
source-controller leaks Azure Storage SAS token into logs in github.com/fluxcd/source-controller...
Slack integration leaks sensitive information in logs
Impact Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge reques...
GHSA-C2G2-GX4J-RJ3J Slack integration leaks sensitive information in logs
Impact Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, it is possible under specific configurations, an attacker can forge reques...
Craft CMS Logs Plugin 3.0.3 - Path Traversal (Authenticated) Vulnerability
Exploit Title: Craft CMS Logs Plugin 3.0.3 - Path Traversal Authenticated Exploit Author: Steffen Rogge Vendor Homepage: https://github.com/ethercreative/logs Software Link: https://plugins.craftcms.com/logs Version: =3.0.4 impact: Medium found: 2021-07-06 SEC Consult Vulnerability Lab An...
Craft CMS Logs Plugin 3.0.3 - Path Traversal (Authenticated)
Exploit Title: Craft CMS Logs Plugin 3.0.3 - Path Traversal Authenticated Date: 2022.01.26 Exploit Author: Steffen Rogge Vendor Homepage: https://github.com/ethercreative/logs Software Link: https://plugins.craftcms.com/logs Version: =3.0.4 impact: Medium found: 2021-07-06 SEC Consult Vulnerabili...
