Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= s…
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volu…
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to atta…
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be avai…
In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available …
In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log during auth…
In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attacke…
In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available t…
Ansible Engine
MEDIUM 5.5
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters mar…
Ansible Engine
HIGH 7.8
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level whi…
Undertow
CRITICAL 9.8
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to o…
Big Ip Access Policy Manager
HIGH 7.5
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are …
Vcenter Server
HIGH 7.7
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to t…
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure v…
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted userna…
GitLab
MEDIUM 6.5
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10…
Kubernetes
MEDIUM 6.5
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via log…
An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visito…
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters…
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables …
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31.
Enterprise Network Function Virtualization Infrastructure
MEDIUM 6.5
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a pas…
Configuration As Code
MEDIUM 5.5
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expec…
Mask Passwords
MEDIUM 6.5
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially…
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
Configuration As Code
MEDIUM 5.5
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
Maven
MEDIUM 6.5
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables…
Ec2
MEDIUM 5.5
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.
Storm
HIGH 7.5
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-i…