Information Disclosure

github.com/kubernetes/kubernetes is vulnerable to information disclosure. The vulnerability exists as bearer tokens are revealed in the system logs...

Information Disclosure

cfme-gemset is vulnerable to information disclosure. Improper authorization in the migration log controller allows any user to access VM migration logs...

cfme: Improper authorization in migration log controller allows any user to access VM migration logs

A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs...

CVE-2019-11250

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components such as kube-apiserver prior to v1.16.0, which make use of basic or bearer token authentication, and run ...

rsyslog security and bug fix update

8.24.0-38.0.2 - Newer gcc complains about implicit declaration of prctl. Added header file to quiesce the compiler 8.24.0-38 RHEL 7.7 ERRATUM - added patch increasing max path size preventing buffer overflow with too long paths resolves: rhbz1656860 8.24.0-37 RHEL 7.7 ERRATUM - edited patch fixin...

spice-gtk security and bug fix update

libgovirt 0.3.4-2 - Parse XML nodes automatically Related: rhbz1427467 - Set detailed error message for async call Related: rhbz1427467 spice-gtk 0.35-4 - Fix bad channel-reset on usbredir Resolves: rhbz1625550 0.35-3 - Fix insufficient encoding checks for LZ Resolves: rhbz1598652 spice-vdagent...

Bearer tokens are revealed in logs (audit finding TOB-K8S-001)

This issue was reported in the Kubernetes Security Audit Report Description Kubernetes requires an authentication mechanism to enforce users’ privileges. One method of authentication, bearer tokens, are opaque strings used to associate a user with their having successfully authenticated previousl...

CVE-2017-18429

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...

CVE-2017-18429

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...

CVE-2017-18429

In cPanel before 66.0.2, Apache HTTP Server SSL domain logs can persist on disk after an account termination SEC-291...

CVE-2017-18429

CVE-2017-18429 affects cPanel before 66.0.2. The issue is that Apache HTTP Server SSL domain logs can persist on disk after an account termination (SEC-291). Several connected sources corroborate the same description, without detailing root cause, exploited vectors, or remediation steps in the pr...

CVE-2017-18412

cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename SEC-296...

CVE-2016-10819

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd SEC-125...

CVE-2018-20932

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

CVE-2018-20932

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

Design/Logic Flaw

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

CVE-2018-20932

CVE-2018-20932 affects cPanel before 70.0.23. The issue arises when certain domains are created, causing exposure of Apache HTTP Server logs and resulting in potential information disclosure. The primary reference is SEC-406. Exploitation status and concrete fixes are not provided in the connecte...

CVE-2018-20932

cPanel before 70.0.23 exposes Apache HTTP Server logs after creation of certain domains SEC-406...

CVE-2019-14456

Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system connected to a serial port on an Opengear console server sends crafted text to a serial port that has logging enabled, the text will b...

Cross site scripting

Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system connected to a serial port on an Opengear console server sends crafted text to a serial port that has logging enabled, the text will b...