Monthly
Unauthenticated log injection in the OPNsense WebGUI login handler lets a network-adjacent attacker forge authentication events that manipulate the firewall's sshlockout protection state. Because the usernamefld parameter prior to version 26.1.11 passes carriage-return and line-feed characters through LOG_AUTH into the syslog-ng lockout pipeline, an attacker who can reach the login page can plant a fabricated failure event naming a victim IP, causing that address to be added to the sshlockout PF table and its active states killed, or plant a forged accepted event to reset their own brute-force counter and defeat password-guessing lockout. The flaw requires no authentication and no user interaction, but the assessed AV:A vector means exploitation presumes adjacency or management-network reachability to the GUI; impact is integrity of lockout state and availability of blocked systems (administrative, DNS, gateway, or monitoring addresses), with no confidentiality impact, and no public exploit or confirmed in-the-wild activity was identified at time of analysis.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Log injection in upKeeper Instant Privilege Access through 1.6.1 on Windows allows remote unauthenticated attackers to forge, tamper with, or inject crafted entries into application logs by smuggling unneutralized control characters through logged inputs. The flaw (CWE-117) does not directly compromise the upKeeper agent itself but produces high integrity, confidentiality, and availability impact on subsequent log-consuming systems (SIEM, audit pipelines). No public exploit identified at time of analysis and the CVE is not present in CISA KEV.
Log injection in IBM Concert 1.0 through 3.0.0 lets remote unauthenticated attackers corrupt or forge log records by supplying input containing special or control characters that the product writes to its log files without neutralization. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the only assessed impact is limited integrity damage to log data - there is no code execution, data disclosure, or availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world severity depends on how downstream log consumers (viewers, SIEM parsers, audit reviews) handle unescaped content.
Source-IP misattribution in fail2ban's default sshd filter allows a remote, unauthenticated attacker to have fail2ban ban an arbitrary IP address of their choosing. Because OpenSSH records the offered username verbatim in its log lines and fail2ban 0.10.5 through 1.1.1 (before commit ddd879d22664904ace24e1255ac6571808c58187) accepts an "on <token>" suffix after the parsed host address, an attacker can connect to the SSH service using a username such as "x VICTIM-IP on" and cause subsequent failed-login entries to be attributed to that victim address, resulting in a temporary firewall block against a legitimate user or host. The impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) with no confidentiality or integrity loss; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated log injection in Splunk Enterprise allows a user whose role carries the read_o11y_content capability to forge entries in the app log through the REST API, but only on deployments where the Splunk App for Splunk O11y Cloud is present and enabled. The root cause is CWE-117 - the app writes user-supplied SignalFlow content into the app log without neutralizing it - producing a low-impact integrity-only result (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with no confidentiality or availability effect, and no public exploit identified at time of analysis. Only Splunk Enterprise releases below 10.4.3, 10.2.7 and 10.0.10 are affected; 9.4.x is explicitly not affected.
Unauthenticated log injection in the OPNsense WebGUI login handler lets a network-adjacent attacker forge authentication events that manipulate the firewall's sshlockout protection state. Because the usernamefld parameter prior to version 26.1.11 passes carriage-return and line-feed characters through LOG_AUTH into the syslog-ng lockout pipeline, an attacker who can reach the login page can plant a fabricated failure event naming a victim IP, causing that address to be added to the sshlockout PF table and its active states killed, or plant a forged accepted event to reset their own brute-force counter and defeat password-guessing lockout. The flaw requires no authentication and no user interaction, but the assessed AV:A vector means exploitation presumes adjacency or management-network reachability to the GUI; impact is integrity of lockout state and availability of blocked systems (administrative, DNS, gateway, or monitoring addresses), with no confidentiality impact, and no public exploit or confirmed in-the-wild activity was identified at time of analysis.
Terminal escape-sequence injection in jahlives openssl_encrypt before 1.4.9 lets an attacker embed control characters in a file's metadata that are emitted verbatim when a victim runs the tool's 'info' command, letting the attacker repaint the terminal and forge the integrity/verification output the tool displays. The practical impact is spoofing: a tampered or malicious file can be made to appear verified or trustworthy to the operator. No public exploit identified at time of analysis, and the flaw requires the victim to run 'info' on attacker-supplied input.
Terminal escape-sequence injection in jahlives' openssl_encrypt (a Python OpenSSL-based file encryption utility) before 1.4.9 lets an attacker embed ANSI/VT control sequences in the key_id field of a crafted encrypted file; because the tool prints this attacker-controlled value unescaped to stderr during decrypt key auto-detection, an attacker can repaint the terminal and forge authenticity-verification output to deceive the operator. Any user who decrypts a malicious file is affected. This is a CWE-117 output-neutralization flaw reported by VulnCheck with no public exploit identified at time of analysis and no CISA KEV listing.
Verdict spoofing in the openssl-encrypt pip package (versions <= 1.4.8) lets an attacker who controls the contents of a scanned drive forge a PASSED tamper-check result. Because filenames read from untrusted drive data are printed by the verify-usb command without neutralizing terminal control bytes, crafted names containing cursor-movement and erase-line sequences can repaint the screen to hide genuine tamper detection. There is no public exploit identified at time of analysis and it is not in CISA KEV; the issue is fixed in 1.4.9, which routes drive-derived names through sanitize_for_display().
Audit-trail corruption and a security-control race condition in the Python library openssl_encrypt (by jahlives) before version 1.4.0 undermine its module-hiding defenses. The restore_hidden_modules() function logs module counts after clearing them, so it always records zero restored modules and produces misleading audit logs (CWE-117), while a separate time-of-check/time-of-use race between module hiding and import-hook installation lets a concurrent thread re-import modules that were meant to be blocked. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis and it is not on CISA KEV.
Remote code execution in IBM Documentation Offline 1.0.0 through 1.4.1 stems from improper neutralization of output written to logs (CWE-117), which a remote attacker can leverage to run arbitrary code with total impact to confidentiality, integrity, and availability. IBM has published a fix, and the vendor CVSS of 9.8 reflects an unauthenticated network-reachable vector; however, EPSS is low (0.27%, 19th percentile) and there is no public exploit identified at time of analysis, so exposure appears theoretical rather than active. Note a signal conflict: the root-cause weakness is log injection, yet the stated impact is code execution - the intermediate mechanism is not documented in the available data.
Log injection in upKeeper Instant Privilege Access through 1.6.1 on Windows allows remote unauthenticated attackers to forge, tamper with, or inject crafted entries into application logs by smuggling unneutralized control characters through logged inputs. The flaw (CWE-117) does not directly compromise the upKeeper agent itself but produces high integrity, confidentiality, and availability impact on subsequent log-consuming systems (SIEM, audit pipelines). No public exploit identified at time of analysis and the CVE is not present in CISA KEV.
Log injection in IBM Concert 1.0 through 3.0.0 lets remote unauthenticated attackers corrupt or forge log records by supplying input containing special or control characters that the product writes to its log files without neutralization. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), so the only assessed impact is limited integrity damage to log data - there is no code execution, data disclosure, or availability loss. No public exploit code or confirmed active exploitation was identified at time of analysis, and real-world severity depends on how downstream log consumers (viewers, SIEM parsers, audit reviews) handle unescaped content.
Source-IP misattribution in fail2ban's default sshd filter allows a remote, unauthenticated attacker to have fail2ban ban an arbitrary IP address of their choosing. Because OpenSSH records the offered username verbatim in its log lines and fail2ban 0.10.5 through 1.1.1 (before commit ddd879d22664904ace24e1255ac6571808c58187) accepts an "on <token>" suffix after the parsed host address, an attacker can connect to the SSH service using a username such as "x VICTIM-IP on" and cause subsequent failed-login entries to be attributed to that victim address, resulting in a temporary firewall block against a legitimate user or host. The impact is availability-only (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium) with no confidentiality or integrity loss; no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authenticated log injection in Splunk Enterprise allows a user whose role carries the read_o11y_content capability to forge entries in the app log through the REST API, but only on deployments where the Splunk App for Splunk O11y Cloud is present and enabled. The root cause is CWE-117 - the app writes user-supplied SignalFlow content into the app log without neutralizing it - producing a low-impact integrity-only result (CVSS 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with no confidentiality or availability effect, and no public exploit identified at time of analysis. Only Splunk Enterprise releases below 10.4.3, 10.2.7 and 10.0.10 are affected; 9.4.x is explicitly not affected.