CWE-117: Improper Output Neutralization for Logs
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Also known as Log forging.
A kind of CWE-116 Improper Encoding or Escaping of Output.
From the CWE List. © The MITRE Corporation.
Newest
- ibm cognos analytics, netapp oncommand insight +1 moreIBM Cognos Analytics log injection8.6 High
- corydolphin corydolphin/flask-cors, flask-cors +1 moreLog Injection Vulnerability in corydolphin/flask-cors5.3 Medium
- getsentry sentrySentry's superuser cleartext password leaked in logs7.3 High
- red hat build of keycloak 22, build of keycloak 22.0.10, single sign-on 7 +5 more +7 moreKeycloak: log injection during webauthn authentication or registration5.3 Medium
- xibosignage xibo, xibo-cms +1 moreSession Hijacking via XSS attack in header and session grid in Xibo CMS8.8 High
- ibm app connect enterprise, integration bus +1 moreIBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosure4.9 Medium
- ckanPotential log injection in reset user endpoint in ckan4.3 Medium
- redhat ansible, fedoraproject fedora, red hat ansible automation platform 2.4 for rhel 8 +7 more +9 moreAnsible-core: possible information leak in tasks that ignore ansible_no_log configuration5.0 Medium
- ibm soar qradar plugin appIBM SOAR QRadar Plugin App log injection4.3 Medium
- kuerp project kuerpSichuan Yougou Technology KuERP log neutralization for logs6.3 Medium
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed...3.1 Low
- integration objects opc ua server toolkitIntegration Objects OPC UA Server Toolkit Improper Output Neutralization for Logs5.3 Medium
- fortinet fortiwebAn improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7...4.9 Medium
- yugabyte yugabytedbLog Injection6.5 Medium
- iterm2iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The...9.8 Critical
- iterm2iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs....9.8 Critical
- red hat amq broker 7, rhel-8 based middleware containers, redhat jboss a-mq +2 more +4 moreOperator: plaintext password in operator log5.5 Medium
- splunk it service intelligence, itsi +1 moreUnauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)8.6 High
- splunk soar, soar (cloud), soar (on-premises) +2 moreUnauthenticated Log Injection In Splunk SOAR8.6 High
- significant-gravitas auto-gpt, agpt autogpt classic +1 moreSystem logs spoofable in Auto-GPT via ANSI control sequences3.1 Low
- sap solution manager, sap se solution manager (diagnostics agent) +1 moreUnauthenticated blind SSRF in SAP Solution Manager (Diagnostics agent)7.2 High
- sap erp defense forces and public securityLog Injection vulnerability in SAP ERP Defense Forces and Public Security4.9 Medium
- sap se netweaver as for java (log viewer), sap netweaver application server for java +1 moreLog Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)5.3 Medium
- splunk, splunk enterprise, universal forwarder +2 moreUnauthenticated Log Injection in Splunk Enterprise8.6 High
- hitachi energy foxman-un, unem +1 moreA vulnerability exists in a FOXMAN-UN and UNEM logging component, it only affects systems that...4.0 Medium
- schneider electric clearscada, ecostruxure geo scada expert 2019, ecostruxure geo scada expert 2020 +1 more +3 moreA CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the...5.3 Medium
- runzero platform, shopware +1 moreImproper Output Neutralization in Log Module in shopware2.7 Low
- cisco openresolveOpenDNS OpenResolve endpoints.py neutralization for logs4.6 Medium
github.com/fkie-cad/yapscanGoYapscan's report receiver server vulnerable to path traversal and log injection7.5 High- simple history project history, unspecified simple history plugin +1 moreSimple History Plugin Header neutralization for logs6.5 Medium
- cognex 3d-a1000 dimensioning system, 3d-a1000 dimensioning system firmware +1 moreCognex 3D-A1000 Dimensioning System Improper Output Neutralization for Logs5.3 Medium
- apache sling api, sling commons log, apache software foundation sling +2 morelog injection in Sling logging5.3 Medium
- crafter software cms, craftercms crafter cms +1 moreImproper Output Neutralization for Logs in Crafter Studio4.3 Medium
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 moreCAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly...8.1 High
- apache airavata django portalairavata-django-portal allows CRLF log injection because of the lack of escaping in the log statements5.3 Medium
- apache supersetPossible log injection6.5 Medium
- vmware spring framework, netapp active iq unified manager, management services for element software and netapp hci +5 more +7 moreImproper Output Neutralization for Logs in Spring Framework4.3 Medium
- mongodb, mongodb inc. server, mongodb, inc. mongodb server +2 moreServer log entry spoofing via newline injection5.3 Medium
- openstack swiftTemporary urls leaked via logging4.3 Medium
- gin-gonic gin, github.com/gin-gonic/gin +1 moreArbitrary log line injection in github.com/gin-gonic/gin7.5 High
- ansible collections project community.crypto, ansible community community collections +1 moreA flaw was found in Ansible Collection community.crypto. openssl_privatekey_info exposes private...7.5 High
- b&r gatemanager, br-automation gatemanager 4260 firmware, gatemanager 8250 firmware +1 more +3 moreGateManager Audit Message Spoofing Vulnerability6.5 Medium
- red hat ansible, redhat ansible engine, debian linux +2 moreInsertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible5.5 Medium
- red hat ansible, debian linux, redhat ansible engine +2 moreImproper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible5.0 Medium
- jhipster generator-jhipster-kotlin, jhipster-kotlin +1 moreLog Forging in generator-jhipster-kotlin5.3 Medium
- redhat openshift container platform, red hat library-go +1 moreOpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the...5.3 Medium
- red hat ansible, debian linux, opensuse backports sle +5 more +7 moreInclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible5.7 Medium
- red hat openshift, redhat openshift container platform +1 moreSensitive Data Exposure in Openshift Container Platform5.3 Medium
- red hat ansible, redhat ansible engine, ansible tower +2 moreAnsible leaks sensitive information to logs when told not to7.3 High
- red hat ansible, redhat ansible engine, debian linux +3 more +5 moreAnsible Uses Plugins That Disclose Credentials7.3 High
- Show moreLoading…