Search
Total
119 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-11336 | 1 Sony | 89 Kdl-50w800c, Kdl-50w805c, Kdl-50w807c and 86 more | 2019-05-21 | 4.3 MEDIUM | 8.1 HIGH |
| Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sharing Plus application to execute a backdoor API command, a different vulnerability than CVE-2019-10886. | |||||
| CVE-2018-19865 | 2 Opensuse, Qt | 2 Leap, Qt | 2019-05-10 | 5.0 MEDIUM | 7.5 HIGH |
| A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. | |||||
| CVE-2019-11492 | 1 Projectsend | 1 Projectsend | 2019-04-30 | 5.0 MEDIUM | 7.5 HIGH |
| ProjectSend before r1070 writes user passwords to the server logs. | |||||
| CVE-2019-9724 | 1 Aquaverde | 1 Aquarius Cms | 2019-04-29 | 5.0 MEDIUM | 7.5 HIGH |
| aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component. | |||||
| CVE-2018-19513 | 1 Ens | 1 Webgalamb | 2019-03-22 | 5.0 MEDIUM | 7.5 HIGH |
| In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors. | |||||
| CVE-2017-15572 | 2 Debian, Redmine | 2 Debian Linux, Redmine | 2019-03-14 | 5.0 MEDIUM | 7.5 HIGH |
| In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect. | |||||
| CVE-2019-0741 | 1 Microsoft | 1 Java Software Development Kit | 2019-03-08 | 5.0 MEDIUM | 7.5 HIGH |
| An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'. | |||||
| CVE-2018-19786 | 1 Hashicorp | 1 Vault | 2018-12-27 | 4.3 MEDIUM | 8.1 HIGH |
| HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported. | |||||
| CVE-2018-14700 | 1 Drobo | 2 5n2, 5n2 Firmware | 2018-12-20 | 5.0 MEDIUM | 7.5 HIGH |
| Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter. | |||||
| CVE-2018-17447 | 1 Citrix | 2 Netscaler Sd-wan, Sd-wan | 2018-12-17 | 5.0 MEDIUM | 7.5 HIGH |
| An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. | |||||
| CVE-2018-1198 | 1 Pivotal Software | 1 Pivotal Cloud Cache | 2018-11-21 | 4.0 MEDIUM | 8.8 HIGH |
| Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs could escalate their privileges using this password. | |||||
| CVE-2018-12604 | 1 Njtech | 1 Greencms | 2018-08-10 | 5.0 MEDIUM | 7.5 HIGH |
| GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. | |||||
| CVE-2018-1000089 | 1 Django-anymail Project | 1 Django-anymail | 2018-04-11 | 4.3 MEDIUM | 7.4 HIGH |
| Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4. | |||||
| CVE-2018-7433 | 1 Ithemes | 1 Security | 2018-03-17 | 5.0 MEDIUM | 7.5 HIGH |
| The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. | |||||
| CVE-2016-6799 | 1 Apache | 1 Cordova | 2017-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications. | |||||
| CVE-2017-5153 | 1 Osisoft | 2 Pi Coresight, Pi Web Api | 2017-03-16 | 2.1 LOW | 7.8 HIGH |
| An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials. | |||||
| CVE-2016-8346 | 1 Moxa | 3 Edr-810, Edr-810-vpn, Edr-810 Firmware | 2017-02-23 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION). | |||||
| CVE-2016-9344 | 1 Moxa | 6 Miineport E1, Miineport E1 Firmware, Miineport E2 and 3 more | 2017-02-23 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files. | |||||
| CVE-2015-8977 | 1 Mybb | 2 Merge System, Mybb | 2017-02-05 | 5.0 MEDIUM | 7.5 HIGH |
| MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files. | |||||