CWE-117 · Improper Output Neutralization for Logs (page 2)
Page 2 of 2 — CVEs classified under CWE-117, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46321 | Critical | 9.8 | 2023-10-23 | iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command l… |
CVE-2023-4065 | Medium | 5.5 | 2023-09-27 | A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. T… |
CVE-2023-4571 | High | 8.6 | 2023-08-30 | In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (AN… |
CVE-2023-3997 | High | 8.6 | 2023-07-31 | Splunk SOAR versions lower than 6.1.0 are indirectly affected by a potential vulnerability accessed through the user’s terminal. A third party can send Splunk… |
CVE-2023-37275 | Low | 3.1 | 2023-07-13 | Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. The Auto-GPT command line UI makes heavy use of co… |
CVE-2023-36924 | Medium | 4.9 | 2023-07-11 | While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows… |
CVE-2023-31405 | Medium | 5.3 | 2023-07-11 | SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network wh… |
CVE-2023-32712 | High | 8.6 | 2023-06-01 | In Splunk Enterprise versions below 9.1.0.2, 9.0.5.1, and 8.2.11.2, an attacker can inject American National Standards Institute (ANSI) escape codes into Splun… |
CVE-2023-1711 | Medium | 4.0 | 2023-05-30 | A vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that use remote authentication to the network elements. If exploited… |
CVE-2023-0595 | Medium | 5.3 | 2023-02-24 | A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to… |
CVE-2015-10011 | Medium | 4.6 | 2023-01-02 | A vulnerability classified as problematic has been found in OpenDNS OpenResolve. This affects an unknown part of the file resolverapi/endpoints.py. The manipul… |
CVE-2022-1522 | Medium | 5.3 | 2022-09-06 | The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which all… |
CVE-2022-32549 | Medium | 5.3 | 2022-06-22 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover trac… |
CVE-2021-23266 | Medium | 4.3 | 2022-05-16 | An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator. |
CVE-2022-22151 | High | 8.1 | 2022-03-11 | CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 t… |
CVE-2021-43410 | Medium | 5.3 | 2021-12-09 | Apache Airavata Django Portal allows CRLF log injection because of lack of escaping log statements. In particular, some HTTP request parameters are logged with… |
CVE-2021-42250 | Medium | 6.5 | 2021-11-17 | Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious co… |
CVE-2021-22096 | Medium | 4.3 | 2021-10-28 | In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the… |
CVE-2021-20333 | Medium | 5.3 | 2021-07-23 | Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log entries to be split. This issue affects… |
CVE-2020-25646 | High | 7.5 | 2020-10-29 | A flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private key in logs. This directly impacts confidentiality |
CVE-2020-11644 | Medium | 6.5 | 2020-10-15 | The information disclosure vulnerability present in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authe… |
CVE-2020-14332 | Medium | 5.5 | 2020-09-11 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed… |
CVE-2020-4072 | Medium | 5.3 | 2020-06-25 | In generator-jhipster-kotlin version 1.6.0 log entries are created for invalid password reset attempts. As the email is provided by a user and the api is publi… |
CVE-2019-14854 | Medium | 6.5 | 2020-01-07 | OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low… |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2019-14858 | Medium | 5.5 | 2019-10-14 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_… |
CVE-2019-14846 | High | 7.8 | 2019-10-08 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to… |
CVE-2018-10932 | Medium | 4.3 | 2018-08-21 | lldptool version 1.0.1 and older can print a raw, unsanitized attacker controlled buffer when mngAddr information is displayed. This may allow an attacker to i… |