Total
758 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-22362 | 1 Akindo-sushiro | 5 Hong Kong Sushiro, Singapore Sushiro, Sushiro and 2 more | 2023-02-24 | N/A | 7.5 HIGH |
| SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SUSHIRO Ver.3.0.2, Singapore SUSHIRO Ver.2.0.0, and Taiwan SUSHIRO Ver.2.0.1 | |||||
| CVE-2023-21435 | 1 Samsung | 1 Android | 2023-02-21 | N/A | 5.5 MEDIUM |
| Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log. | |||||
| CVE-2023-25163 | 1 Linuxfoundation | 1 Argo Continuous Delivery | 2023-02-18 | N/A | 6.5 MEDIUM |
| Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error. The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway. A patch for this vulnerability has been released in version 2.6.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | |||||
| CVE-2023-25164 | 1 Tina | 1 Tinacms | 2023-02-18 | N/A | 7.5 HIGH |
| Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/cli@1.0.9. Users are advised to upgrade. There are no known workarounds for this issue. | |||||
| CVE-2018-1075 | 1 Ovirt | 1 Ovirt | 2023-02-13 | 2.1 LOW | 7.8 HIGH |
| ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords. | |||||
| CVE-2018-16889 | 1 Redhat | 1 Ceph | 2023-02-13 | 5.0 MEDIUM | 7.5 HIGH |
| Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaintext. Versions up to v13.2.4 are vulnerable. | |||||
| CVE-2019-14854 | 1 Redhat | 1 Openshift Container Platform | 2023-02-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user. | |||||
| CVE-2019-10213 | 1 Redhat | 2 Enterprise Linux, Openshift Container Platform | 2023-02-12 | 4.0 MEDIUM | 6.5 MEDIUM |
| OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user. | |||||
| CVE-2017-7550 | 1 Redhat | 2 Ansible, Enterprise Linux Server | 2023-02-12 | 5.0 MEDIUM | 9.8 CRITICAL |
| A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation. | |||||
| CVE-2017-2621 | 2 Openstack, Redhat | 2 Heat, Openstack | 2023-02-12 | 2.1 LOW | 5.5 MEDIUM |
| An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made world readable. A malicious system user could exploit this flaw to access sensitive information. | |||||
| CVE-2016-5432 | 1 Redhat | 2 Enterprise Linux, Enterprise Virtualization | 2023-02-12 | 2.1 LOW | 3.3 LOW |
| The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files. | |||||
| CVE-2016-4443 | 1 Redhat | 1 Enterprise Virtualization | 2023-02-12 | 2.1 LOW | 5.5 MEDIUM |
| Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file. | |||||
| CVE-2020-10712 | 1 Redhat | 1 Openshift Container Platform | 2023-02-12 | 6.4 MEDIUM | 8.2 HIGH |
| A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity. | |||||
| CVE-2021-36544 | 1 Tpcms Project | 1 Tpcms | 2023-02-10 | N/A | 7.5 HIGH |
| Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. | |||||
| CVE-2019-4296 | 1 Ibm | 1 Robotic Process Automation With Automation Anywhere | 2023-02-03 | 2.1 LOW | 3.3 LOW |
| IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759. | |||||
| CVE-2019-4225 | 1 Ibm | 1 Pureapplication System | 2023-02-03 | 2.1 LOW | 4.4 MEDIUM |
| IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 159242. | |||||
| CVE-2022-20458 | 1 Google | 1 Android | 2023-02-01 | N/A | 5.5 MEDIUM |
| The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776 | |||||
| CVE-2019-4299 | 1 Ibm | 1 Robotic Process Automation With Automation Anywhere | 2023-01-31 | 1.9 LOW | 5.5 MEDIUM |
| IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765. | |||||
| CVE-2019-10695 | 1 Puppet | 1 Continuous Delivery | 2023-01-28 | 4.0 MEDIUM | 6.5 MEDIUM |
| When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the job’s Job Details pane in the PE console. These issues have been resolved in version 1.2.1 of the puppetlabs/cd4pe module. | |||||
| CVE-2023-22733 | 1 Shopware | 1 Shopware | 2023-01-25 | N/A | 6.5 MEDIUM |
| Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have access to other users accounts. This issue has been addressed in version 6.4.18.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Users unable to upgrade may remove from all users the log module ACL rights or disable logging. | |||||