SAMSUNG Watch Active Plugin 日志信息泄露漏洞

The SAMSUNG Galaxy Watch Plugin is a component of a Galaxy Wearable application from Samsung South Korea. A log information disclosure vulnerability exists in versions prior to SAMSUNG Watch Active Plugin 2.2.05.22012751, which allows an attacker to access password information for WiFiAp in logs...

SAMSUNG Watch Active2 Plugin 日志信息泄露漏洞

SAMSUNG Watch Active2 Plugin is a component of a Galaxy Wearable application from Samsung South Korea. A log information disclosure vulnerability exists in versions prior to SAMSUNG Watch Active2 Plugin 2.2.08.22012751, which allows an attacker to access password information for WiFiAp in logs...

Samsung Galaxy Watch Plugin 日志信息泄露漏洞

Samsung Galaxy Watch Plugin is a component of the Galaxy Wearable application for Samsung mobile devices. previous versions of Samsung Galaxy Watch Plugin 2.2.05.220126741 are vulnerable to information disclosure, which could be exploited by attackers to access user information in the logs...

CVE-2021-36809

A local attacker can overwrite arbitrary files on the system with VPN client logs using administrator privileges, potentially resulting in a denial of service and data loss, in all versions of Sophos SSL VPN client...

PT-2022-17555 · Unknown · Watch Active2 Plugin

Name of the Vulnerable Software and Affected Versions: Watch Active2 Plugin versions prior to 2.2.08.22012751 Description: The issue allows an attacker to access password information of connected WiFi access points in the log. Recommendations: For versions prior to 2.2.08.22012751, update to...

CVE-2022-26311

Couchbase Operator 2.2.x before 2.2.3 exposes Sensitive Information to an Unauthorized Actor. Secrets are not redacted in logs collected from Kubernetes environments...

CVE-2021-25009

The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses...

PT-2022-13391 · Keepass · Keepass

Name of the Vulnerable Software and Affected Versions: KeePass affected versions not specified Description: A flaw in KeePass leads to an Information Exposure issue due to the logging of plain text passwords in the system log. This allows an attacker to interact with and read sensitive passwords...

PT-2022-12019 · Apache +2 · Apache Http Server +2

Name of the Vulnerable Software and Affected Versions: Northern.tech CFEngine Enterprise versions prior to 3.15.5 Northern.tech CFEngine Enterprise versions 3.18.x prior to 3.18.1 Description: The issue is related to insecure permissions, which may allow unauthorized local users to access log...

The vulnerability of the log4js-node logging library, related to deficiencies in access control, allows attackers to gain access to confidential information.

The vulnerability of the log4js-node logging library is related to deficiencies in access control for directories. Exploiting this vulnerability could allow attackers to gain access to confidential information stored in logs generated by the file, fileSync, and dateFile applications...

Conti chat logs leaked as ransomware gang sides with Russia

By Waqas The individual responsible for leaking Conti chat logs has warned the ransomware gang that more files will be… This is a post from HackRead.com Read the original post: Conti chat logs leaked as ransomware gang sides with Russia...

Conti Ransomware Group Internal Chats Leaked Over Russia-Ukraine Conflict

UPDATE: As of March 2, 2022, Conti began taking down exposed infrastructure as a result of the chat disclosure. At that time, we assessed that due to their sophisticated capability, deep funding, and quick recovery from exposed infrastructure in November 2021, they remained an active and...

Conti Ransomware Gang's Internal Chats Leaked Online After Siding With Russia

Days after the Conti ransomware group broadcasted a pro-Russian message pledging its allegiance to Vladimir Putin's ongoing invasion of Ukraine, an anonymous security researcher using the Twitter handle @ContiLeaks has leaked the syndicate's internal chats. The file dump, published by malware...

Security Bulletin: IBM MQ Appliance could allow unauthorized viewing of logs and files (CVE-2022-22326)

Summary IBM MQ Appliance has resolved a vulnerability that could allow unauthorized viewing of logs and files. Vulnerability Details CVEID: CVE-2022-22326 DESCRIPTION: IBM MQ Appliance could allow unauthorized viewing of logs and files due to insufficient authorisation checks. CVSS Base score: 4...

CVE-2022-0385

The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting...

Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...

Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...

Citrix Provisioning Services - How To Gather CDF Traces

Starting in 1912 LTSR Citrix Provisioning Services improves on the CDF integration that kicked off in the earlier 7.0 days. This now includes the ability to natively maintain persistent rolling CDF trace logs on each PVS Server and Targets if necessary without the need for additional capture...

Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...

Unauthorised AJAX Calls via Freemius

Description The plugins and themes use an insecure version of the Freemius Framework, which is lacking CSRF and/or authorisation in some of its AJAX actions. As a result, any authenticated users, such as subscriber could access the debug logs. Unauthenticated attackers could also make a logged in...