PT-2020-9187

Name of the Vulnerable Software and Affected Versions Pivotal Ops Manager versions 2.4.x prior to 2.4.27 Pivotal Ops Manager versions 2.5.x prior to 2.5.24 Pivotal Ops Manager versions 2.6.x prior to 2.6.16 Pivotal Ops Manager versions 2.7.x prior to 2.7.5 Description The issue allows logging of...

CVE-2019-11292: Insertion of Sensitive Information into Log File

Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...

CVE-2019-11293

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...

CVE-2019-11293

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...

Authentication flaw

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...

CVE-2019-11293 UAA logs all query parameters with debug logging level

Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...

PT-2019-12233

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA Release versions prior to 74.10.0 Description The issue allows a remote authenticated malicious user to gain access to user credentials via the uaa.log file if authentication is provided via query parameters, when the logging...

CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...

PT-2019-12232

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA Release versions prior to 74.8.0 Description The issue concerns the logging of query parameters, including potential authentication credentials, to tomcat's access file. This could lead to sensitive information being stored i...

CVE-2019-11290: Insertion of Sensitive Information into Log File

Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...

CVE-2019-11290: UAA logs query parameters in tomcat access file | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, they will be logged as well. Affected Cloud Foundry...

Arbitrary Variants Via Query Parameters

Due to unvalidated input, an attacker can pass in arbitrary variants via query parameters. If an application treats variants as trusted, this can lead to potential vulnerabilities like SQL injection or cross-site scripting XSS. For instance: landingpage = fieldtest:landingpage Page.where"key =...

SQL Injection

Overview All versions of untitled-model re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation No fix is currently available. Consider using an alternative package until a fix is mad...

SQL Injection

resquel is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements in the application due to the lack of query parameters sanitization...

CVE-2019-7409

Multiple cross-site scripting XSS vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the 1 page, 2 gbs, 3 side, 4 id, 5 imgid, 6 cat, or 7 orderby parameter...

Cross-site scripting vulnerability in VIVOTEK Network Camera series products (CNVD-2019-00683)

VIVOTEK Network Camera Series is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the eventscript.js file in the VIVOTEK Network Camera Series using firmware versions 0x06x to 0x08x. The vulnerability can be exploited by a remote attacker to...

Mezzanine Cross-Site Scripting Vulnerability

Mezzanine CMS is a set of open source content management system CMS built using the DJANGO framework. A cross-site scripting vulnerability exists in admin/blog/blogpost/add/ in Mezzanine CMS version 4.3.1. A remote attacker can create a cross-site scripting vulnerability in...

Security Bulletin: IBM Security Guardium is affected by a Query Parameter in SSL Request vulnerability

Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1272 DESCRIPTION: IBM Security Guardium stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server...

Reflected XSS vulnerability in Job Config History Plugin

Job Config History Plugin did not escape some query parameters shown on its pages, resulting in a reflected cross-site scripting XSS vulnerability. Job Config History Plugin now globally applies variable escaping to its pages...

PT-2018-5647 · Insteon · Insteon Hub

Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A stack-based buffer overflow issue exists due to the HTTP server implementation unsafely extracting parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HT...