Monthly
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are reproduced in plaintext within the driver's diagnostic string representation of its client settings, rather than being masked like other secret fields. Any party with read access to application logs, diagnostic output, or process memory dumps can recover these credentials and independently invoke the key management service to unwrap data-encryption keys, compromising all data protected by those keys. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; exploitation is bounded by the requirement that CSFLE be configured and that the attacker have access to diagnostic output.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
MongoDB BI Connector's mongodrdl tool leaks TLS private-key passwords to standard error when the password is simultaneously supplied via both the connection URI and a corresponding command-line option. Affected versions span BI Connector 2.12.0 through 2.14.29; the fix is version 2.14.30. A local attacker who can read captured stderr output and also possesses the encrypted TLS client key file can combine those two artifacts to authenticate as the legitimate TLS client identity. No public exploit code or active exploitation has been identified at time of analysis.
Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
HCL BigFix Quantum Risk Analyzer exposes sensitive internal application data through excessively verbose default logging, classified under CWE-532. The CVSS vector (AV:L/PR:H) confirms exploitation requires local, privileged access to the host system - a meaningful barrier that confines risk to insider threats or post-compromise scenarios rather than remote attack. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account credentials to a support log file in cleartext, leaving them recoverable by any local user with read permissions on that log. Documented via HackerOne and Veeam KB4902, this CWE-532 information disclosure flaw affects all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-privileged account to fully compromise active administrator sessions without knowing the administrator's password. The device writes live plaintext session identifiers for authenticated users into downloadable error log archives (CWE-532), enabling any authenticated low-privileged user to extract and replay admin tokens. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack requires no specialized tooling and only minimal network access.
Sensitive KMS provider credentials supplied for client-side field-level encryption (CSFLE) in the MongoDB C# Driver are reproduced in plaintext within the driver's diagnostic string representation of its client settings, rather than being masked like other secret fields. Any party with read access to application logs, diagnostic output, or process memory dumps can recover these credentials and independently invoke the key management service to unwrap data-encryption keys, compromising all data protected by those keys. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis; exploitation is bounded by the requirement that CSFLE be configured and that the attacker have access to diagnostic output.
Sensitive data exposure in Spring Cloud Stream versions 4.2.0-4.2.6, 4.3.0-4.3.3, and 5.0.0-5.0.2 allows logging of sensitive information - such as message payloads, headers, or configuration values - under specific conditions. The vulnerability is classified as information disclosure with a low CVSS base score of 3.1, reflecting the high attack complexity and privilege requirements. No public exploit code has been identified and this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Spring Cloud Function's Azure integration may inadvertently log sensitive data across three affected release lines (4.2.0-4.2.7, 4.3.0-4.3.4, 5.0.0-5.0.3), resulting in low-impact information disclosure. The vulnerability is constrained by a high-privilege, high-complexity, user-interaction-required exploitation profile (CVSS 3.1), making it a low-priority issue for most organizations. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog; the primary risk is credential or token leakage through application log aggregators accessible to operators or compromised log pipelines.
Spring Cloud Function's AWS adapter component may inadvertently write sensitive data to application logs, creating an information disclosure exposure across a wide range of maintained version branches (3.x through 5.x). The CVSS score of 3.1 reflects genuinely low severity - exploitation requires high privileges and high attack complexity - but the risk in regulated or multi-tenant environments is elevated if log stores are accessible to unauthorized parties or if sensitive data (credentials, payloads, tokens) persists in cloud-native logging services such as AWS CloudWatch. No public exploit code exists and no active exploitation has been identified at time of analysis.
MongoDB BI Connector's mongodrdl tool leaks TLS private-key passwords to standard error when the password is simultaneously supplied via both the connection URI and a corresponding command-line option. Affected versions span BI Connector 2.12.0 through 2.14.29; the fix is version 2.14.30. A local attacker who can read captured stderr output and also possesses the encrypted TLS client key file can combine those two artifacts to authenticate as the legitimate TLS client identity. No public exploit code or active exploitation has been identified at time of analysis.
Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.
Cleartext password leakage in openssl-encrypt before 1.4.9 exposes file encryption credentials in debug output when passwords are supplied via bundled short-option or abbreviated long-option argument forms. The tool's sanitizer, which is designed to redact sensitive arguments before writing the argv dump to stderr, fails to recognize spellings like -apHunter2 (bundled short option) or --passw (abbreviated long option), causing the raw password to appear in terminal scrollback, CI job logs, and persistent GUI debug logs. No public exploit identified at time of analysis; the vulnerability is trivially exploitable by any party with read access to the affected log output.
HCL BigFix Quantum Risk Analyzer exposes sensitive internal application data through excessively verbose default logging, classified under CWE-532. The CVSS vector (AV:L/PR:H) confirms exploitation requires local, privileged access to the host system - a meaningful barrier that confines risk to insider threats or post-compromise scenarios rather than remote attack. No public exploit code exists and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
Credential exposure in Veeam Backup & Replication occurs when guest OS processing operations write privileged account credentials to a support log file in cleartext, leaving them recoverable by any local user with read permissions on that log. Documented via HackerOne and Veeam KB4902, this CWE-532 information disclosure flaw affects all tracked versions per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-privileged account to fully compromise active administrator sessions without knowing the administrator's password. The device writes live plaintext session identifiers for authenticated users into downloadable error log archives (CWE-532), enabling any authenticated low-privileged user to extract and replay admin tokens. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack requires no specialized tooling and only minimal network access.