361 matches found
CVE-2022-29869
A flaw was found in cifs-utils. When verbose logging is enabled, invalid credentials file lines may be dumped to stderr. This may lead to information disclosure in particular conditions when the credentials file given is sensitive and contains '=' signs...
GHSA-27RQ-4943-QCWP Insertion of Sensitive Information into Log File in Hashicorp go-getter
The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile...
AZL-39837 CVE-2021-3602 affecting package cri-o for versions less than 1.21.7-2
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...
buildah: Host environment variables leaked in build container when using chroot isolation
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...
buildah: Host environment variables leaked in build container when using chroot isolation
An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...
Automatic referer leaks credentials
libcurl does not strip off user credentials from the URL when automatically populating the Referer: HTTP request header field in outgoing HTTP requests, and therefore risks leaking sensitive data to the server that is the target of the second HTTP request. libcurl automatically sets the Referer:...
CVE-2021-21361
The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...
Information disclosure
The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...
CVE-2021-21361 Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixe...
CVE-2021-21361
The CVE-2021-21361 entry concerns the Gradle plugin com.bmuschko:gradle-vagrant-plugin, which exposes an information disclosure vulnerability by logging system environment variables when the plugin runs in public CI/CD environments. Affected component: the GDKExternalProcessExecutor.groovy flow a...
IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability (CNVD-2021-10819)
IBM Security Identity Governance and Intelligence is an integrated identity management solution based on network devices. An information disclosure vulnerability exists in IBM Security Identity Governance and Intelligence 5.2.6. A local attacker could exploit this vulnerability to obtain sensitiv...
GHSA-8GV6-G7VP-HR34 mysqljs is malware
The mysqljs package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concern...
mysqljs is malware
The mysqljs package is a piece of malware that steals environment variables and sends them to attacker controlled locations. All versions have been unpublished from the npm registry. Recommendation As this package is malware, if you find it installed in your environment, the real security concern...
Design/Logic Flaw
VMware Tanzu Application Service for VMs 2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7 contains an App Autoscaler that logs the UAA admin password. This credential is redacted on VMware Tanzu Operations Manager; however, the unredacted logs are...
CVE-2020-5414
The CVE-2020-5414 entry concerns VMware Tanzu Application Service for VMs (2.7.x prior to 2.7.19, 2.8.x prior to 2.8.13, 2.9.x prior to 2.9.7) where the App Autoscaler logs UAA admin and App Autoscaler Broker passwords. Logs are redacted in VMware Tanzu Operations Manager, but unredacted logs wer...
CVE-2020-13223
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...
Denial of service
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...
CVE-2020-13223
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2...
CVE-2020-13223
CVE-2020-13223 affects HashiCorp Vault and Vault Enterprise. The issue arises from logging proxy environment variables that could reveal sensitive credentials. This is documented across multiple sources (e.g., NVD, osv, CNVD) with fixed versions identified as 1.3.6 and 1.4.2. Impact is informatio...
