795 matches found
CVE-2019-11292
CVE-2019-11292 affects Pivotal Ops Manager: versions 2.4.x before 2.4.27, 2.5.x before 2.5.24, 2.6.x before 2.6.16, and 2.7.x before 2.7.5 log all query parameters to Tomcat’s access log; if params serve authentication, credentials may be logged. Root cause: parameter logging leakage into logs. I...
CVE-2019-11292 Pivotal Ops Manager logs query parameters in tomcat access file
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...
CVE-2019-11293
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...
CVE-2019-11293
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...
Authentication flaw
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...
CVE-2019-11293 UAA logs all query parameters with debug logging level
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs clientsecret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authentication is provided via query parameters...
CVE-2019-11290 Cloud Foundry UAA logs query parameters in tomcat access file
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well...
CVE-2019-11290: UAA logs query parameters in tomcat access file | Cloud Foundry
Severity High Vendor Cloud Foundry Foundation Description Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, they will be logged as well. Affected Cloud Foundry...
Arbitrary Variants Via Query Parameters
Due to unvalidated input, an attacker can pass in arbitrary variants via query parameters. If an application treats variants as trusted, this can lead to potential vulnerabilities like SQL injection or cross-site scripting XSS. For instance: landingpage = fieldtest:landingpage Page.where"key =...
SQL Injection
Overview All versions of untitled-model re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries. Recommendation No fix is currently available. Consider using an alternative package until a fix is mad...
SQL Injection
resquel is vulnerable to SQL injection. A remote attacker is able to inject and execute arbitrary SQL statements in the application due to the lack of query parameters sanitization...
CVE-2019-7409
Multiple cross-site scripting XSS vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the 1 page, 2 gbs, 3 side, 4 id, 5 imgid, 6 cat, or 7 orderby parameter...
Cross-site scripting vulnerability in VIVOTEK Network Camera series products (CNVD-2019-00683)
VIVOTEK Network Camera Series is a series of network camera products from China VIVOTEK. A cross-site scripting vulnerability exists in the eventscript.js file in the VIVOTEK Network Camera Series using firmware versions 0x06x to 0x08x. The vulnerability can be exploited by a remote attacker to...
Mezzanine Cross-Site Scripting Vulnerability
Mezzanine CMS is a set of open source content management system CMS built using the DJANGO framework. A cross-site scripting vulnerability exists in admin/blog/blogpost/add/ in Mezzanine CMS version 4.3.1. A remote attacker can create a cross-site scripting vulnerability in...
Security Bulletin: IBM Security Guardium is affected by a Query Parameter in SSL Request vulnerability
Summary IBM Security Guardium has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1272 DESCRIPTION: IBM Security Guardium stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server...
PT-2018-5647 · Insteon · Insteon Hub
Name of the Vulnerable Software and Affected Versions: Insteon Hub version 1012 Description: A stack-based buffer overflow issue exists due to the HTTP server implementation unsafely extracting parameters from the query string, leading to a buffer overflow on the stack. An attacker can send an HT...
Web Application Penetration Testing Tool: Tracy
Tracy is a pentesting tool designed to assist with finding all sinks and sources of a web application and display these results in a digestible manner. tracy should be used during the mapping-the-application phase of the pentest to identify sources of input and their corresponding outputs. tracy...
IBM API Connect Information Disclosure Vulnerability (CNVD-2018-03882)
IBM API Connect aka APIConnect is an integrated solution for managing the API lifecycle from IBM USA. The solution supports creating, running, managing and securing APIs, microservices and more. An information disclosure vulnerability exists in IBM API Connect versions 5.0.7.0 through 5.0.7.2 and...