Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
816 results · page 9 of 17
Apr 19, 2023Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported.CVE-2022-2084 · Other software · Canonical Ltd. · reported by security@ubuntu.comMedium 5.5
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
- Product
- cloud-init
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2023Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit loggiCVE-2023-1831 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comHigh 7.2
Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled (ExperimentalAuditSettings section in config).
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Apr 14, 2023TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in theCVE-2023-29801 · Other software · Totolink · reported by MITRECritical 9.8
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.
- Product
- X18 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsore-pail-31b.notion.sitesore-pail-31b.notion.site
Apr 12, 2023The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging iCVE-2023-23591 · Other software · Terminalfour · reported by MITREMedium 4.9
The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging is enabled. The fixed versions are 8.2.18.7, 8.2.18.2.2, 8.3.11.1, and 8.3.14.1.
- Product
- Terminalfour
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.terminalfour.comdocs.terminalfour.com
Apr 10, 2023Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute CVE-2023-27497 · Network & remote access · SAP · reported by cna@sap.comCritical 10
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
- Product
- Diagnostics Agent (EventLogServiceCollector)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Apr 5, 2023Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795CVE-2022-31889 · Other software · Enhancesoft · reported by MITREMedium 6.1
Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
- Product
- Audit LOG
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcheckmarx.comgithub.com
Mar 29, 2023Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the targeCVE-2023-28892 · Other software · Malwarebytes · reported by MITREHigh 7.8
Malwarebytes AdwCleaner 8.4.0 runs as Administrator and performs an insecure file delete operation on C:\AdwCleaner\Logs\AdwCleaner_Debug.log in which the target location is user-controllable, allowing a non-admin user to escalate privileges to SYSTEM via a symbolic link.
- Product
- Adwcleaner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforums.malwarebytes.commalwarebytes.com
Mar 27, 2023An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs.CVE-2023-22300 · Other software · SAUTER · reported by ics-cert@hq.dhs.govMedium 6.1
An unauthenticated remote attacker could force all authenticated users, such as administrative users, to perform unauthorized actions by viewing the logs. This action would also grant the attacker privilege escalation.
- Product
- EY-AS525F001 with moduWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2023Juiker app stores debug logs which contains sensitive information to mobile external storage.CVE-2022-39043 · Other software · Juiker · reported by twcert@cert.org.twLow 2.4
Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to acquire partial user information such as personal contacts.
- Product
- Juiker app
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Mar 18, 2023In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.CVE-2022-48425 · Computers, phones & browsers · Linux · reported by MITREHigh 7.8
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
- Product
- Linux Kernel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 6, 2023An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.CVE-2023-22858 · Other software · BlogEngine.NET · reported by vdp@themissinglink.com.auMedium 5.3
An Improper Access Control vulnerability in BlogEngine.NET 3.3.8.0, allows unauthenticated visitors to access the files of unpublished blogs.
- Product
- BlogEngine.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordthemissinglink.com.authemissinglink.com.au
Mar 1, 2023A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.CVE-2022-48309 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.3
A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
- Product
- Sophos Connect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2023A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to tCVE-2023-0595 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)
- Product
- EcoStruxure Geo SCADA Expert 2019
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddownload.schneider-electric.comdownload.schneider-electric.com
Feb 6, 2023An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuratCVE-2022-48164 · Other software · Wavlink · reported by MITREHigh 7.5
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
- Product
- Wl-wn533a8 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Feb 3, 2023An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuratCVE-2022-48165 · Other software · Wavlink · reported by MITREHigh 7.5
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
- Product
- Wl-wn530h4 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.google.comgithub.com
Jan 30, 2023An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5.CVE-2022-42484 · Other software · FreshTomato · reported by talos-cna@cisco.comCritical 9.8
An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- FreshTomato
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Jan 26, 2023The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build.CVE-2022-20458 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 2, 2023Autoptimize: Uses an easily guessable path to store plugin's exported settings and logsCVE-2022-4057 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
- Product
- Autoptimize
- Fixed in
- 3.1.0
- What to do
- Update Autoptimize to 3.1.0 or newer.
Dec 30, 2022Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configuraCVE-2022-4858 · Other software · M-Files · reported by security@m-files.comMedium 4.4
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
- Product
- M-Files Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordempower.m-files.comproduct.m-files.com
Dec 12, 2022A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-prCVE-2022-23511 · Other software · aws · reported by GitHubHigh 7.1
A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-premises servers, in versions up to and including v1.247354. When users trigger a repair of the Agent, a pop-up window opens with SYSTEM permissions. Users with administrative access to affected hosts may use this to create a new command prompt as NT AUTHORITY\SYSTEM. To trigger this issue, the third party must be able to access the affected host and elevate their privileges such that they're able to trigger the agent repair process. They must also be able to install the tools required to trigger the issue. This issue does not affect the CloudWatch Agent for macOS or Linux. Agent users should upgrade to version 1.247355 of the CloudWatch Agent to address this issue. There is no recommended work around. Affected users must update the installed version of the CloudWatch Agent to address this issue.
- Product
- amazon-cloudwatch-agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2022Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs.CVE-2022-33187 · Other software · Brocade · reported by sirt@brocade.comMedium 5.5
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Nov 16, 2022Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.CVE-2022-24036 · Other software · Karmasis Informatics · reported by iletisim@usom.gov.trHigh 8.6
Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.
- Product
- Infraskope SIEM+
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkarmasis.comsiberguvenlik.gov.tr
Nov 15, 2022A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.CVE-2022-45394 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.
- Product
- Jenkins Delete log Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 15, 2022A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.CVE-2022-45393 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comLow 3.5
A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs.
- Product
- Jenkins Delete log Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 15, 2022Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site sCVE-2022-45387 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 5.4
Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability.
- Product
- Jenkins BART Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Nov 15, 2022Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2.CVE-2022-27895 · Other software · Palantir · reported by cve-coordination@palantir.comMedium 4.2
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
- Product
- Foundry Build2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs.CVE-2022-40405 · Other software · Wowonder · reported by MITREHigh 7.5
WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs.
- Product
- Wowonder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2022Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.CVE-2022-43288 · Other software · Rukovoditel · reported by MITREHigh 8.8
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php.
- Product
- Rukovoditel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 3, 2022Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be resCVE-2021-44862 · Other software · Netskope · reported by psirt@netskope.comHigh 8.4
Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before writing in the logs. A malicious user can use the sensitive information to download data and impersonate another user.
- Product
- NSClient
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnetskope.comnetskope.com
Oct 17, 2022Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1CVE-2022-3293 · Websites & servers · GitLab · reported by cve@gitlab.comLow 3.5
Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2022Helpful: Puts the exported logs and feedbacks in a publicly accessible location and guessable namesCVE-2022-2834 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Helpful WordPress plugin before 4.5.26 puts the exported logs and feedbacks in a publicly accessible location and guessable names, which could allow attackers to download them and retrieve sensitive information such as IP, Names and Email Address depending on the plugin's settings
- Product
- Helpful
- Fixed in
- 4.5.26
- What to do
- Update Helpful to 4.5.26 or newer.
Oct 13, 2022Grafana is an open source data visualization platform for metrics, logs, and traces.CVE-2022-39229 · Other software · grafana · reported by GitHubMedium 4.3
Grafana is an open source data visualization platform for metrics, logs, and traces. Versions prior to 9.1.8 and 8.5.14 allow one user to block another user's login attempt by registering someone else'e email address as a username. A Grafana user’s username and email address are unique fields, that means no other user can have the same username or email address as another user. A user can have an email address as a username. However, the login system allows users to log in with either username or email address. Since Grafana allows a user to log in with either their username or email address, this creates an usual behavior where `user_1` can register with one email address and `user_2` can register their username as `user_1`’s email address. This prevents `user_1` logging into the application since `user_1`'s password won’t match with `user_2`'s email address. Versions 9.1.8 and 8.5.14 contain a patch. There are no workarounds for this issue.
- Product
- grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2022IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs.CVE-2022-39168 · Other software · IBM · reported by psirt@us.ibm.comHigh 7.5
IBM Robotic Process Automation Clients are vulnerable to proxy credentials being exposed in upgrade logs. IBM X-Force ID: 235422.
- Product
- Robotic Process Automation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Sep 28, 2022A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in thCVE-2022-23716 · Other software · Elastic · reported by security@elastic.coMedium 5.3
A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.
- Product
- Elastic Cloud Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddiscuss.elastic.coelastic.co
Sep 23, 2022A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.CVE-2022-32217 · Other software · Rocket.chat · reported by support@hackerone.comMedium 5.3
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
- Product
- Rocket.chat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
Sep 13, 2022Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.CVE-2022-31861 · Other software · Thingsboard · reported by MITREMedium 5.4
Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
- Product
- Thingsboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityblog101.blogspot.comsecurityblog101.blogspot.com
Sep 6, 2022The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which alloCVE-2022-1522 · Other software · Cognex · reported by ics-cert@hq.dhs.govMedium 5.3
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics.
- Product
- 3D-A1000 Dimensioning System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2022Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.CVE-2022-34624 · Other software · Mealie · reported by MITREMedium 5.9
Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
- Product
- Mealie
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgainsec.comgainsec.com
Aug 1, 2022IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and fileCVE-2022-22326 · Other software · IBM · reported by psirt@us.ibm.comLow 3.3
IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856.
- Product
- DataPower Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Jul 15, 2022In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.CVE-2022-34826 · Other software · Couchbase · reported by MITREMedium 5.9
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
- Product
- Couchbase Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcouchbase.comcouchbase.com
Jul 10, 2022The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyCVE-2022-31520 · Other software · Logstash-management-api Project · reported by MITRECritical 9.3
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
- Product
- Logstash-management-api
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 24, 2022XSS in /dashboard/reports/logs/view - old browsers only.CVE-2022-30119 · Other software · Concretecms · reported by support@hackerone.comMedium 6.1
XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 2 with CVSS v3.1 Vector AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N. Thanks zeroinside for reporting.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
May 20, 2022The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used.CVE-2022-28660 · Other software · Grafana · reported by MITRECritical 9.8
The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1.3.1, and 1.4.0 contain the bugfix. This affects -auth.type=enterprise in microservices mode
- Product
- Grafana
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrafana.comsecurity.netapp.com
May 12, 2022In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possibleCVE-2022-29928 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.4
In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 9, 2022Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.CVE-2022-28162 · Other software · Broadcom · reported by sirt@brocade.comLow 3.3
Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text.
- Product
- Sannav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
May 3, 2022Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.CVE-2022-28055 · Other software · Fusionpbx · reported by MITRECritical 9.8
Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.
- Product
- Fusionpbx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 29, 2022Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.CVE-2022-29947 · Other software · Woodpecker-ci · reported by MITREMedium 6.1
Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
- Product
- Woodpecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 18, 2022Easy Digital Downloads: Does not sanitise and escape the Downloadable File Name in the LogsCVE-2022-0706 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
- Product
- Easy Digital Downloads
- Fixed in
- 2.11.6
- What to do
- Update Easy Digital Downloads to 2.11.6 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Apr 11, 2022The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter.CVE-2021-22055 · Other software · VMware · reported by security@vmware.comMedium 5.3
The SchedulerServer in Vmware photon allows remote attackers to inject logs through \r in the package parameter. Attackers can also insert malicious data and fake entries.
- Product
- Photon OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 28, 2022Block Bad Bots: Does not properly sanitise and escape the User Agent before using it in a SQL statement to record logsCVE-2021-25070 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
- Product
- Block Bad Bots
- Fixed in
- 6.88
- What to do
- Update Block Bad Bots to 6.88 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.