9713 matches found
Ethercreative Logs 3.0.3 Path Traversal
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Authenticated Path Traversal product: Ethercreative Logs plugin for Craft CMS vulnerable version: =3.0.4 CVE number: CVE-2022-23409 impact: Medium homepage:...
CVE-2021-25078
The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...
CVE-2021-24696
The Simple Download Monitor WordPress plugin before 3.9.9 does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1 make admins export logs to exploit a separate log disclosure vulnerability fixed in 3.9.6, 2 delete logs fixed in 3.9.9, 3 remove thumbnail image from...
Jenkins batch task Plugin cross-site request forgery vulnerability
Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins batch task Plugin 1.19 and earlier versions are vulnerable to cross-site request forgery. An attacker with...
Cisco ASDM Information Disclosure (cisco-sa-asdm-logging-jnLOY422)
An information disclosure vulnerability exists in Cisco Adaptive Security Device Manager ASDM due to the storage of unencrypted credentials in certain logs. An authenticated, local attacker can exploit this, by accessing the logs on an affected system, to view the credentials of other users of th...
log4j-core: Remote code execution in Log4j 2.x when logs contain an attacker-controlled string value
A flaw was found in the Apache Log4j logging library in versions from 2.0.0 and before 2.15.0. A remote attacker who can control log messages or log message parameters, can execute arbitrary code on the server via JNDI LDAP endpoint...
DEBIAN-CVE-2022-21704
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable in unix. This could cause problems if log files contain sensitive information. This would affect any users that have not...
UBUNTU-CVE-2022-21704
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable in unix. This could cause problems if log files contain sensitive information. This would affect any users that have not...
CVE-2021-31821
When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in plaintext. This does not affect the Linux Docker image...
CVE-2021-41808 In M-Files Server product with versions before 21.11.10775.0, enabling logging of federated authentication would write sensitive information to event logs.
In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default...
Stormshield SSO 日志信息泄露漏洞
Stormshield SES Evolution is a security solution from the French company Stormshield. A security vulnerability exists in Stormshield SSO that stems from plaintext user passwords and PSKs being included in the log files of the .exe installer...
The vulnerability of the Ansible configuration management system arises from improper processing of output data for registration logs, allowing an attacker to access confidential information.
The vulnerability of the Ansible configuration management system is related to incorrect processing of output data for registration logs. Exploiting this vulnerability can allow an attacker to gain access to confidential data...
CVE-2021-44234
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information...
CVE-2021-44234
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information...
Storefront unable to communicate with Delivery controllers over HTTPS.
SSL Error on Storefront Event Logs:...
IBM Sterling Gentran 日志信息泄露漏洞
IBM Sterling Gentran is a versatile, high-performance solution from IBM USA designed to help exchange EDI and other types of data. A log information disclosure vulnerability exists in IBM Sterling Gentran that stems from storing potentially sensitive information in log files that can be read by...
GHSA-MH8G-8JWP-Q6XW CSRF vulnerability in Jenkins batch task Plugin
Cross-site request forgery CSRF vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task...
CSRF vulnerability in Jenkins batch task Plugin
Cross-site request forgery CSRF vulnerabilities in Jenkins batch task Plugin 1.19 and earlier allows attackers with Overall/Read access to retrieve logs, build or delete a batch task...
CVE-2022-23109
Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed...