Common Weakness Enumeration
CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1744 vulnerabilities reference this CWE, most recent first.
CVE-2024-28830 (GCVE-0-2024-28830)
Vulnerability from cvelistv5 – Published: 2024-06-26 07:56 – Updated: 2024-08-02 00:56
VLAI
EPSS
VEX
Title
Automation user secrets written to audit log
Summary
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user secrets to be written to audit log files accessible to administrators.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://checkmk.com/werk/17056 |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Checkmk GmbH | Checkmk |
Affected:
2.3.0 , < 2.3.0p7
(semver)
Affected: 2.2.0 , < 2.2.0p28 (semver) Affected: 2.1.0 , < 2.1.0p45 (semver) Affected: 2.0.0 , ≤ 2.0.0p39 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28830",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-26T14:02:28.117222Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T14:02:43.497Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:56:58.058Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://checkmk.com/werk/17056"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Checkmk",
"vendor": "Checkmk GmbH",
"versions": [
{
"lessThan": "2.3.0p7",
"status": "affected",
"version": "2.3.0",
"versionType": "semver"
},
{
"lessThan": "2.2.0p28",
"status": "affected",
"version": "2.2.0",
"versionType": "semver"
},
{
"lessThan": "2.1.0p45",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.0.0p39",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Insertion of Sensitive Information into Log File in Checkmk GmbH\u0027s Checkmk versions \u003c2.3.0p7, \u003c2.2.0p28, \u003c2.1.0p45 and \u003c=2.0.0p39 (EOL) causes automation user secrets to be written to audit log files accessible to administrators."
}
],
"impacts": [
{
"capecId": "CAPEC-560",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-560: Use of Known Domain Credentials"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 2.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-26T07:56:57.020Z",
"orgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"shortName": "Checkmk"
},
"references": [
{
"url": "https://checkmk.com/werk/17056"
}
],
"title": "Automation user secrets written to audit log"
}
},
"cveMetadata": {
"assignerOrgId": "f7d6281c-4801-44ce-ace2-493291dedb0f",
"assignerShortName": "Checkmk",
"cveId": "CVE-2024-28830",
"datePublished": "2024-06-26T07:56:57.020Z",
"dateReserved": "2024-03-11T13:21:43.122Z",
"dateUpdated": "2024-08-02T00:56:58.058Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28236 (GCVE-0-2024-28236)
Vulnerability from cvelistv5 – Published: 2024-03-12 20:41 – Updated: 2024-08-02 00:48
VLAI
EPSS
VEX
Title
Insecure Variable Substitution in Vela
Summary
Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and — by using common substitution string manipulation — can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the "no commands" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. **To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive. While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the "no commands" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security. This issue has been addressed in version 0.23.2. Users are advised to upgrade. Users unable to upgrade should not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values, ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive, minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process, make use of the build approval setting, restricting builds from untrusted users, and limit use of shared secrets, as they are less restrictive to access by nature.
Severity
7.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/go-vela/worker/security/adviso… | x_refsource_CONFIRM |
| https://github.com/go-vela/worker/commit/e1572743… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28236",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-13T14:30:51.704354Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:03:18.752Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.488Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h"
},
{
"name": "https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "worker",
"vendor": "go-vela",
"versions": [
{
"status": "affected",
"version": "\u003c 0.23.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secrets into a plugin/image and \u2014 by using common substitution string manipulation \u2014 can bypass log masking and expose secrets without the use of the commands block. This unexpected behavior primarily impacts secrets restricted by the \"no commands\" option. This can lead to unintended use of the secret value, and increased risk of exposing the secret during image execution bypassing log masking. **To exploit this** the pipeline author must be supplying the secrets to a plugin that is designed in such a way that will print those parameters in logs. Plugin parameters are not designed for sensitive values and are often intentionally printed throughout execution for informational/debugging purposes. Parameters should therefore be treated as insensitive. While Vela provides secrets masking, secrets exposure is not entirely solved by the masking process. A docker image (plugin) can easily expose secrets if they are not handled properly, or altered in some way. There is a responsibility on the end-user to understand how values injected into a plugin are used. This is a risk that exists for many CICD systems (like GitHub Actions) that handle sensitive runtime variables. Rather, the greater risk is that users who restrict a secret to the \"no commands\" option and use image restriction can still have their secret value exposed via substitution tinkering, which turns the image and command restrictions into a false sense of security. This issue has been addressed in version 0.23.2. Users are advised to upgrade. Users unable to upgrade should not provide sensitive values to plugins that can potentially expose them, especially in `parameters` that are not intended to be used for sensitive values, ensure plugins (especially those that utilize shared secrets) follow best practices to avoid logging parameters that are expected to be sensitive, minimize secrets with `pull_request` events enabled, as this allows users to change pipeline configurations and pull in secrets to steps not typically part of the CI process, make use of the build approval setting, restricting builds from untrusted users, and limit use of shared secrets, as they are less restrictive to access by nature."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-12T20:41:09.271Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/go-vela/worker/security/advisories/GHSA-pwx5-6wxg-px5h"
},
{
"name": "https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/go-vela/worker/commit/e1572743b008e4fbce31ebb1dcd23bf6a1a30297"
}
],
"source": {
"advisory": "GHSA-pwx5-6wxg-px5h",
"discovery": "UNKNOWN"
},
"title": "Insecure Variable Substitution in Vela"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28236",
"datePublished": "2024-03-12T20:41:09.271Z",
"dateReserved": "2024-03-07T14:33:30.035Z",
"dateUpdated": "2024-08-02T00:48:49.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28186 (GCVE-0-2024-28186)
Vulnerability from cvelistv5 – Published: 2024-03-12 19:36 – Updated: 2024-08-02 00:48
VLAI
EPSS
VEX
Title
SMTP Mail Credentials Disclosed in Error Log in freescout
Summary
FreeScout is an open source help desk and shared inbox built with PHP.
A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=&thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator->authenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised to upgrade. Users unable to upgrade should adopt the following measures: 1. Avoid Storing Complete Stack Traces, 2. Implement redaction mechanisms to filter and exclude sensitive information, and 3. Review and enhance the application's logging practices.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/freescout-helpdesk/freescout/s… | x_refsource_CONFIRM |
| https://github.com/freescout-helpdesk/freescout/c… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| freescout-helpdesk | freescout |
Affected:
< 1.8.124
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28186",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-03-13T14:10:40.413463Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T18:03:28.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:49.423Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-7wcq-2qmv-mvcm",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-7wcq-2qmv-mvcm"
},
{
"name": "https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "freescout",
"vendor": "freescout-helpdesk",
"versions": [
{
"status": "affected",
"version": "\u003c 1.8.124"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "FreeScout is an open source help desk and shared inbox built with PHP.\n\nA vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue arises from the application storing complete stack traces of exceptions in its database. The sensitive information is then inadvertently disclosed to users via the `/conversation/ajax-html/send_log?folder_id=\u0026thread_id={id}` endpoint. The stack trace reveals value of parameters, including the username and password, passed to the `Swift_Transport_Esmtp_Auth_LoginAuthenticator-\u003eauthenticate()` function. Exploiting this vulnerability allows an attacker to gain unauthorized access to SMTP server credentials. With this sensitive information in hand, the attacker can potentially send unauthorized emails from the compromised SMTP server, posing a severe threat to the confidentiality and integrity of email communications. This could lead to targeted attacks on both the application users and the organization itself, compromising the security of email exchange servers. This issue has been addressed in version 1.8.124. Users are advised to upgrade. Users unable to upgrade should adopt the following measures: 1. Avoid Storing Complete Stack Traces, 2. Implement redaction mechanisms to filter and exclude sensitive information, and 3. Review and enhance the application\u0027s logging practices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-12T19:36:05.964Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-7wcq-2qmv-mvcm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/freescout-helpdesk/freescout/security/advisories/GHSA-7wcq-2qmv-mvcm"
},
{
"name": "https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/freescout-helpdesk/freescout/commit/33639a89554998dcac645613130a27ac7872605e"
}
],
"source": {
"advisory": "GHSA-7wcq-2qmv-mvcm",
"discovery": "UNKNOWN"
},
"title": "SMTP Mail Credentials Disclosed in Error Log in freescout"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-28186",
"datePublished": "2024-03-12T19:36:05.964Z",
"dateReserved": "2024-03-06T17:35:00.858Z",
"dateUpdated": "2024-08-02T00:48:49.423Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-28072 (GCVE-0-2024-28072)
Vulnerability from cvelistv5 – Published: 2024-05-03 07:50 – Updated: 2024-08-02 00:48
VLAI
EPSS
VEX
Title
Arbitrary File Overwrite Vulnerability
Summary
A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly.
Severity
5.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| SolarWinds | Serv-U |
Affected:
15.4.2 and Previous Versions
|
|
| solarwinds | serv-u |
Affected:
0 , ≤ 15.4.2
(custom)
cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*"
],
"defaultStatus": "affected",
"product": "serv-u",
"vendor": "solarwinds",
"versions": [
{
"lessThanOrEqual": "15.4.2",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-28072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-03T19:58:49.881343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-24T17:45:43.053Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:48:48.228Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28072"
},
{
"tags": [
"x_transferred"
],
"url": "https://solarwindscore.my.site.com/SuccessCenter/s/article/Serv-U-15-4-2-Hotfix-1-Release-Notes?language=en_US"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Serv-U",
"vendor": "SolarWinds ",
"versions": [
{
"status": "affected",
"version": "15.4.2 and Previous Versions "
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Alexander Skovsende at the Institute for Cyber Risk"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. \u003cbr\u003e\n\n\n\n\n\n"
}
],
"value": "A highly privileged account can overwrite arbitrary files on the system with log output. The log file path tags were not sanitized properly. \n\n\n\n\n\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-165",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-165 File Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-05-03T07:50:00.696Z",
"orgId": "49f11609-934d-4621-84e6-e02e032104d6",
"shortName": "SolarWinds"
},
"references": [
{
"url": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2024-28072"
},
{
"url": "https://solarwindscore.my.site.com/SuccessCenter/s/article/Serv-U-15-4-2-Hotfix-1-Release-Notes?language=en_US"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSolarWinds recommends \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ethat \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ecustomers upgrade to \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eSolarWinds\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e S\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eerv-U\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e version \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e15.4.2\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e Hotfix \u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e1\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e as soon as it becomes available\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e.\u003c/span\u003e\n\n"
}
],
"value": "\nSolarWinds recommends that customers upgrade to SolarWinds Serv-U version 15.4.2 Hotfix 1 as soon as it becomes available.\n\n"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Arbitrary File Overwrite Vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "49f11609-934d-4621-84e6-e02e032104d6",
"assignerShortName": "SolarWinds",
"cveId": "CVE-2024-28072",
"datePublished": "2024-05-03T07:50:00.696Z",
"dateReserved": "2024-03-01T08:53:44.513Z",
"dateUpdated": "2024-08-02T00:48:48.228Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27784 (GCVE-0-2024-27784)
Vulnerability from cvelistv5 – Published: 2024-07-09 15:33 – Updated: 2026-01-09 16:34
VLAI
EPSS
VEX
Summary
Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Information disclosure
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Fortinet | FortiAIOps |
Affected:
2.0.0
cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:* |
|
| fortinet | fortiaiops |
Affected:
2.0.0
cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "fortiaiops",
"vendor": "fortinet",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27784",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T17:36:54.102419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-10T21:11:54.984Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:55.221Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072",
"tags": [
"x_transferred"
],
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:fortinet:fortiaiops:2.0.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "FortiAIOps",
"vendor": "Fortinet",
"versions": [
{
"status": "affected",
"version": "2.0.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated, remote attacker to retrieve sensitive information from the API endpoint or log files."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "Information disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-09T16:34:54.891Z",
"orgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"shortName": "fortinet"
},
"references": [
{
"name": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-072"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to FortiAIOps version 2.0.1 or above"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6abe59d8-c742-4dff-8ce8-9b0ca1073da8",
"assignerShortName": "fortinet",
"cveId": "CVE-2024-27784",
"datePublished": "2024-07-09T15:33:27.590Z",
"dateReserved": "2024-02-26T14:46:31.335Z",
"dateUpdated": "2026-01-09T16:34:54.891Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-27157 (GCVE-0-2024-27157)
Vulnerability from cvelistv5 – Published: 2024-06-14 03:22 – Updated: 2025-02-13 17:46
VLAI
EPSS
VEX
Title
Leak of authentication sessions in secure logs
Summary
The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Toshiba Tec Corporation | Toshiba Tec e-Studio multi-function peripheral (MFP) |
Affected:
see the reference URL
|
Date Public
2024-06-14 02:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-15T20:51:41.389397Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-15T20:51:59.211Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.245Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "see the reference URL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
}
],
"datePublic": "2024-06-14T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
}
],
"value": "The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
}
],
"value": "We are not aware of any malicious exploitation by these vulnerabilities."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-04T05:06:21.397Z",
"orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"shortName": "Toshiba"
},
"references": [
{
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
}
],
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-14T02:00:00.000Z",
"value": "Fixes will be released"
}
],
"title": "Leak of authentication sessions in secure logs",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
}
],
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"assignerShortName": "Toshiba",
"cveId": "CVE-2024-27157",
"datePublished": "2024-06-14T03:22:31.415Z",
"dateReserved": "2024-02-21T02:11:56.735Z",
"dateUpdated": "2025-02-13T17:46:03.782Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27156 (GCVE-0-2024-27156)
Vulnerability from cvelistv5 – Published: 2024-06-14 03:20 – Updated: 2025-02-13 17:46
VLAI
EPSS
VEX
Title
Leak of authentication sessions in secure logs
Summary
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Toshiba Tec Corporation | Toshiba Tec e-Studio multi-function peripheral (MFP) |
Affected:
see the reference URL
|
Date Public
2024-06-14 02:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T18:15:44.657901Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T18:15:52.105Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "see the reference URL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
}
],
"datePublic": "2024-06-14T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
}
],
"value": "The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
}
],
"value": "We are not aware of any malicious exploitation by these vulnerabilities."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-04T05:06:32.872Z",
"orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"shortName": "Toshiba"
},
"references": [
{
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
}
],
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-14T02:00:00.000Z",
"value": "Fixes will be released"
}
],
"title": "Leak of authentication sessions in secure logs",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
}
],
"value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"assignerShortName": "Toshiba",
"cveId": "CVE-2024-27156",
"datePublished": "2024-06-14T03:20:49.798Z",
"dateReserved": "2024-02-21T02:11:56.735Z",
"dateUpdated": "2025-02-13T17:46:03.200Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27154 (GCVE-0-2024-27154)
Vulnerability from cvelistv5 – Published: 2024-06-14 02:58 – Updated: 2025-02-13 17:46
VLAI
EPSS
VEX
Title
Passwords are stored in clear-text logs.
Summary
Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL.
Severity
6.2 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
Impacted products
51 products
| Vendor | Product | Version | |
|---|---|---|---|
| Toshiba Tec Corporation | Toshiba Tec e-Studio multi-function peripheral (MFP) |
Affected:
see the reference URL
|
|
| toshibatec | e-studio-2521_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2521_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2515-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2515-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2020_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2020_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2520_nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2520_nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2021_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2021_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3025_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3025_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6525_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6525_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6525_acg |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6525_acg:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3028-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3028-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3528-ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3528-ag:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4528-ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4528-ag:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6528-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6528-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6526-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6526-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6527-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6527-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-7527-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-7527-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-6529-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-6529-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-7529-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-7529-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-9029-a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-9029-a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-330-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-330-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-400-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-400-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2010-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2010-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2110-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2110-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2510-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2510-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2610-ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2610-ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2015-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2015-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2615-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2615-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3015-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3015-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3115-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3115-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3515-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3515-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3615-nc |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3615-nc:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4515_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4515_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-4615_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-4615_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5015_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5015_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-5115_ac |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-5115_ac:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2018_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2018_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2518_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2518_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-2618_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-2618_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3018_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3018_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3118_a |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3118_a:-:*:*:*:*:*:*:* |
|
| toshibatec | e-studio-3118_ag |
Affected:
0 , ≤ *
(custom)
cpe:2.3:h:toshibatec:e-studio-3118_ag:-:*:*:*:*:*:*:* |
Date Public
2024-06-14 02:00
Credits
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2521_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2521_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2515-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2515-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2020_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2020_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2520_nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2520_nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2021_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2021_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3025_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3025_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6525_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6525_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6525_acg:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6525_acg",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3028-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3028-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3528-ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3528-ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4528-ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4528-ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6528-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6528-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6526-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6526-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6527-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6527-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-7527-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-7527-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-6529-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-6529-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-7529-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-7529-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-9029-a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-9029-a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-330-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-330-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-400-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-400-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2010-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2010-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2110-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2110-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2510-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2510-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2610-ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2610-ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2015-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2015-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2615-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2615-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3015-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3015-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3115-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3115-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3515-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3515-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3615-nc:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3615-nc",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4515_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4515_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-4615_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-4615_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5015_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5015_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-5115_ac:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-5115_ac",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2018_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2018_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2518_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2518_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-2618_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-2618_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3018_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3018_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3118_a:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3118_a",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:toshibatec:e-studio-3118_ag:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "e-studio-3118_ag",
"vendor": "toshibatec",
"versions": [
{
"lessThanOrEqual": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27154",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-16T17:34:14.177643Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-16T17:38:31.324Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.466Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "see the reference URL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
}
],
"datePublic": "2024-06-14T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL."
}
],
"value": "Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
}
],
"value": "We are not aware of any malicious exploitation by these vulnerabilities."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-04T05:06:22.988Z",
"orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"shortName": "Toshiba"
},
"references": [
{
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
}
],
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-14T02:00:00.000Z",
"value": "Fixes will be released"
}
],
"title": "Passwords are stored in clear-text logs.",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"assignerShortName": "Toshiba",
"cveId": "CVE-2024-27154",
"datePublished": "2024-06-14T02:58:55.751Z",
"dateReserved": "2024-02-21T02:11:56.735Z",
"dateUpdated": "2025-02-13T17:46:01.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27097 (GCVE-0-2024-27097)
Vulnerability from cvelistv5 – Published: 2024-03-13 20:40 – Updated: 2024-08-21 15:05
VLAI
EPSS
VEX
Title
Potential log injection in reset user endpoint in ckan
Summary
A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/ckan/ckan/security/advisories/… | x_refsource_CONFIRM |
| https://github.com/ckan/ckan/commit/81b56c55e5e36… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.495Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j"
},
{
"name": "https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27097",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-21T15:05:35.728864Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-21T15:05:52.767Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "ckan",
"vendor": "ckan",
"versions": [
{
"status": "affected",
"version": "\u003e= 2.0, \u003c 2.9.11"
},
{
"status": "affected",
"version": "\u003e= 2.10.0, \u003c 2.10.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A user endpoint didn\u0027t perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN versions 2.9.11 and 2.10.4. Users are advised to upgrade. Users unable to upgrade should override the `/user/reset` endpoint to filter the `id` parameter in order to exclude newlines.\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-13T20:40:50.855Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ckan/ckan/security/advisories/GHSA-8g38-3m6v-232j"
},
{
"name": "https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/ckan/ckan/commit/81b56c55e5e3651d7fcf9642cd5a489a9b62212c"
}
],
"source": {
"advisory": "GHSA-8g38-3m6v-232j",
"discovery": "UNKNOWN"
},
"title": "Potential log injection in reset user endpoint in ckan"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-27097",
"datePublished": "2024-03-13T20:40:50.855Z",
"dateReserved": "2024-02-19T14:43:05.993Z",
"dateUpdated": "2024-08-21T15:05:52.767Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-25959 (GCVE-0-2024-25959)
Vulnerability from cvelistv5 – Published: 2024-03-28 17:49 – Updated: 2024-08-16 20:01
VLAI
EPSS
VEX
Summary
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure, escalation of privileges.
Severity
7.9 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/00022336… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Dell | PowerScale OneFS |
Affected:
9.4.0.0 , ≤ 9.4.0.16
(semver)
Affected: 9.5.0.0 , ≤ 9.5.0.7 (semver) Affected: 9.6.1.0 , ≤ 9.7.0.0 (semver) Affected: 9.7.0.0 , ≤ 9.7.0.1 (semver) |
|
| dell | powerscale_onefs |
Affected:
9.4.0.0 , ≤ 9.4.0.16
(semver)
Affected: 9.5.0.0 , ≤ 9.5.0.7 (semver) Affected: 9.6.1.0 , ≤ 9.7.0.0 (semver) Affected: 9.7.0.0 , ≤ 9.7.0.1 (semver) cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:* |
Date Public
2024-03-28 06:30
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:52:06.441Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:dell:powerscale_onefs:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "powerscale_onefs",
"vendor": "dell",
"versions": [
{
"lessThanOrEqual": "9.4.0.16",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.0.7",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.7.0.1",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-25959",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-09T15:12:12.827681Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-16T20:01:09.901Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PowerScale OneFS",
"vendor": "Dell",
"versions": [
{
"lessThanOrEqual": "9.4.0.16",
"status": "affected",
"version": "9.4.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.5.0.7",
"status": "affected",
"version": "9.5.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.7.0.0",
"status": "affected",
"version": "9.6.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "9.7.0.1",
"status": "affected",
"version": "9.7.0.0",
"versionType": "semver"
}
]
}
],
"datePublic": "2024-03-28T06:30:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure, escalation of privileges."
}
],
"value": "Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive information disclosure, escalation of privileges."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532: Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-28T17:52:03.526Z",
"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"shortName": "dell"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
"assignerShortName": "dell",
"cveId": "CVE-2024-25959",
"datePublished": "2024-03-28T17:49:47.793Z",
"dateReserved": "2024-02-13T05:32:19.480Z",
"dateUpdated": "2024-08-16T20:01:09.901Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation
Architecture and Design
Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Distribution
Remove debug log files before deploying the application into production.
Mitigation
Operation
Protect log files against unauthorized read/write.
Mitigation
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.