CWE-117 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-117/ Sun, 26 Feb 2023 06:45:03 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-117 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-117/ 32 32 CVE-2018-10932 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-10932/ Sun, 26 Feb 2023 06:45:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-10932/ lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.

The post CVE-2018-10932 appeared first on CVE Vulnerability.

]]> lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to inject shell control characters into the buffer and impact the behavior of the terminal.

The post CVE-2018-10932 appeared first on CVE Vulnerability.

]]> CVE-2020-4072 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-4072/ Sun, 26 Feb 2023 06:41:54 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-4072/ In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using […]

The post CVE-2020-4072 appeared first on CVE Vulnerability.

]]> In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is public this can be used by an attacker to forge log entries. This is vulnerable to https://cwe.mitre.org/data/definitions/117.html This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable. This issue has been fixed in version 1.7.0.

The post CVE-2020-4072 appeared first on CVE Vulnerability.

]]> CVE-2020-14332 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-14332/ Sun, 26 Feb 2023 06:37:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-14332/ A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (–check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

The post CVE-2020-14332 appeared first on CVE Vulnerability.

]]> A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (–check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

The post CVE-2020-14332 appeared first on CVE Vulnerability.

]]> CVE-2019-14846 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-14846/ Sun, 26 Feb 2023 06:30:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-14846/ In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

The post CVE-2019-14846 appeared first on CVE Vulnerability.

]]> In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

The post CVE-2019-14846 appeared first on CVE Vulnerability.

]]> CVE-2019-14854 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-14854/ Sun, 26 Feb 2023 06:30:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-14854/ OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

The post CVE-2019-14854 appeared first on CVE Vulnerability.

]]> OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

The post CVE-2019-14854 appeared first on CVE Vulnerability.

]]> CVE-2019-14864 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-14864/ Sun, 26 Feb 2023 06:30:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-14864/ Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

The post CVE-2019-14864 appeared first on CVE Vulnerability.

]]> Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

The post CVE-2019-14864 appeared first on CVE Vulnerability.

]]> CVE-2019-10213 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-10213/ Sun, 26 Feb 2023 06:29:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-10213/ OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a […]

The post CVE-2019-10213 appeared first on CVE Vulnerability.

]]> OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

The post CVE-2019-10213 appeared first on CVE Vulnerability.

]]> CVE-2023-0595 https://cvevulnerability.com/cve_vulnerabilities/cve-2023-0595/ Sun, 26 Feb 2023 06:08:41 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2023-0595/ A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server’s database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA […]

The post CVE-2023-0595 appeared first on CVE Vulnerability.

]]> A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server’s database web port (default 443). Affected products: EcoStruxure Geo SCADA Expert 2019, EcoStruxure Geo SCADA Expert 2020, EcoStruxure Geo SCADA Expert 2021(All Versions prior to October 2022), ClearSCADA (All Versions)

The post CVE-2023-0595 appeared first on CVE Vulnerability.

]]> CVE-2022-4011 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-4011/ Thu, 23 Feb 2023 05:20:31 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-4011/ A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack may be initiated remotely. The exploit has been disclosed to the public and may be […]

The post CVE-2022-4011 appeared first on CVE Vulnerability.

]]> A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213785 was assigned to this vulnerability.

The post CVE-2022-4011 appeared first on CVE Vulnerability.

]]> CVE-2022-1522 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-1522/ Thu, 23 Feb 2023 05:02:07 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-1522/ The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics.

The post CVE-2022-1522 appeared first on CVE Vulnerability.

]]> The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics.

The post CVE-2022-1522 appeared first on CVE Vulnerability.

]]>