kube-audit-rest's example logging configuration could disclose secret values in the audit log

Impact What kind of vulnerability is it? Who is impacted? If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. Patches Has the problem been patched? What versions should use...

CVE-2025-24884

The CVE-2025-24884 entry concerns kube-audit-rest, a simple logger for Kubernetes API mutations. When the here-described full-elastic-stack example vector is used, previous values of Kubernetes secrets could be disclosed in audit messages due to the logger capturing sensitive data. Fixed in versi...

CVE-2025-22607 Coolify Vulnerable to GitHub / GitLab OAuth Secrets Leak

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.361, the missing authorization allows any authenticated user to fetch the details page for any GitHub / GitLab configuration on a Coolify instance by only knowing the UU...

CVE-2024-57727

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing...

CVE-2024-45497

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories...

Malicious code in @bh-ui/theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15abe0453d257e63379c13d84f7269d636310eb7d9abb1a0ae02740475e71ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11197 Malicious code in stacks-blockchain-dist-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b57ff71a1fa8a796d254711f77c61001b106406614239e93a1b59405fc6c1a3b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11144 Malicious code in imgur-upload-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70fc21112f21105a413aa69a8b3e3f21c53895809a2f5fd20cdbf6dd16baadfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-32406 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p22 Checkmk versions prior to 2.2.0p37 Checkmk versions prior to 2.1.0p50 EOL Description: The issue concerns the insertion of sensitive information into log files in Checkmk, causing remote site secrets to be...

MAL-2024-11017 Malicious code in web-framework-addons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5274032fc0a53368c86dc7ddfbf044a3eaf831203e6b9f1df908fa32ba29050c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JCGG-MG9G-P9WF Duplicate Advisory: Keycloak Build Process Exposes Sensitive Data

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7gv-xpgf-6395. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue occurs because sensitive runtime values, such as passwords, may be captured...

Broadcom SANnav 安全漏洞

Broadcom SANnav is a suite of SAN management platforms from Broadcom Corporation USA. A security vulnerability exists in Broadcom SANnav versions prior to 2.2.2, which stems from the presence of information disclosure through a log file vulnerability, where configuration secrets are recorded in...

CVE-2024-52582

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-52582 cachi2 allows traceback prints locals

Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolated. Prior to version 0.14.0, secrets may be shown in logs when an unhandled exception is triggered because the tool is logging locals of each function. This...

CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

Important: Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 Openshift Jenkins security update

An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.14. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

MAL-2024-9316 Malicious code in 844b5t (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c94eb1a3b22cc1d70762d22b1b4267f152ebd42f59622a80427938d470e946ea Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9399 Malicious code in zip-mp3-a-lbum-do-wnload-new-coexist-l4rjg-vsisft (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbda29687ce05eceb8a7140f99fe1073db44c499a2817a3334aba733cda1eb29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-38862

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions 2.3.0p18, 2.2.0p35, 2.1.0p48 and =2.0.0p39 EOL causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators...

MAL-2024-9115 Malicious code in 0sxokg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8003ec05e6cd5bd8b902c112c898d9937aa19d167ed2d0cf3b33ffbcb41542f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...