cve.bz

OWASP A09:2025 Logging & Alerting Failures vulnerabilities, newest first, page 31

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A09:2025 at MITRE.

Its weaknesses: 5

CWE-117, CWE-221, CWE-223, CWE-532, CWE-778

  1. 4.3CVE-2016-2928EPSS 1.0%

    IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs.

  2. 5.5CVE-2016-5967EPSS 0.3%

    The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs.

  3. 3.3CVE-2016-5432EPSS 0.3%

    The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

  4. 7.5CVE-2016-0879EPSS 2.2%

    Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspe…

  5. 7.5CVE-2016-0875EPSS 1.8%

    Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.

  6. –CVE-2013-6384EPSS 0.4%

    (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 o…

  7. 7.5CVE-2013-4733EPSS 2.2%

    The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log file…

  8. 6.5CVE-2012-0814EPSS 3.6%

    The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by read…

  9. –CVE-2011-1943EPSS 0.2%

    The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive informat…

  10. –CVE-2001-1556EPSS 3.6%

    The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewe…