Monthly
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 fail to consistently write successful authentication events to the audit log, which degrades a customer's ability to detect and investigate unauthorized access or credential misuse. The exposure is limited to logging/visibility: independent assessment rates the impact as integrity-only against the audit record (C:N/I:L/A:N), and the flaw gives an attacker no access by itself - harm only materialises after a separate successful authentication with legitimate or stolen credentials. There is no public exploit identified at time of analysis, and remediation is an upgrade to 12.1.0 or 11.3.7 or later.
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the risk is real for security teams relying on this package as a primary CloudTrail integrity control.
LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Insufficient logging in Tanium Server branches 7.7.3, 7.8.2, and 7.8.4 can cause certain privileged operations to be incompletely recorded in audit logs, weakening forensic visibility and log integrity (CWE-778); the flaw requires high-privileged authenticated access (PR:H) and carries a low CVSS score of 2.7. No public exploit code has been identified at time of analysis, and Tanium has released fixed builds for all three affected branches.
OpenBao's unauthenticated root-token generation and rekey endpoints can complete operations without a corresponding response audit record when request audit logging succeeds but response audit logging fails, reducing forensic visibility. OpenBao versions before 2.6.4 and 2.7.x before 2.7.1 are affected, but the impacted endpoints are disabled by default since OpenBao 2.5.3 and must be explicitly enabled for exploitation. No public exploit identified at time of analysis, and the issue is a low-severity logging gap rather than a path to secret disclosure or modification.
Silent suppression of Windows event-log records in Apache log4net's EventLogAppender lets a party that can influence logged content erase a whole event record without any error being raised. Applications on Windows that use EventLogAppender in log4net 1.2.9 through versions before 3.5.0 are affected: messages are truncated to a hard-coded 31,837-character ceiling that exceeds the real Event Log record budget once the log name, source name, and machine name are counted, so the service silently stores and reports nothing for the oversized record. No public exploit identified at time of analysis, and the independent assessment rates this a genuine but low-priority, niche-configuration issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), since an attacker must be able to push a single logged message into the tens-of-kilobytes range.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.
MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 fail to consistently write successful authentication events to the audit log, which degrades a customer's ability to detect and investigate unauthorized access or credential misuse. The exposure is limited to logging/visibility: independent assessment rates the impact as integrity-only against the audit record (C:N/I:L/A:N), and the flaw gives an attacker no access by itself - harm only materialises after a separate successful authentication with legitimate or stolen credentials. There is no public exploit identified at time of analysis, and remediation is an upgrade to 12.1.0 or 11.3.7 or later.
Incomplete CloudTrail event-selector tampering detection in @hulumi/baseline before 1.3.2 (CWE-778: Insufficient Logging) creates blind spots in AWS audit trail monitoring, allowing threat actors who have already modified CloudTrail event selectors to evade detection by the library's checks. The affected npm package misses specific forms of event-selector manipulation, reducing coverage for changes to audit logging configuration - a technique commonly used to suppress evidence of adversarial cloud activity. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the risk is real for security teams relying on this package as a primary CloudTrail integrity control.
LDAP authentication bypass in phpMyFAQ 3.1.0-4.1.6 allows a blocked local account to be silently reactivated by authenticating via LDAP, letting previously suspended users regain full application access. The AuthLdap::create() method calls User::setStatus('active') unconditionally after any successful LDAP bind, overwriting an administratively set 'blocked' status in the database without logging the state change. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; the vendor-confirmed fixed release is 4.1.7.
Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.
Insufficient logging in Tanium Server branches 7.7.3, 7.8.2, and 7.8.4 can cause certain privileged operations to be incompletely recorded in audit logs, weakening forensic visibility and log integrity (CWE-778); the flaw requires high-privileged authenticated access (PR:H) and carries a low CVSS score of 2.7. No public exploit code has been identified at time of analysis, and Tanium has released fixed builds for all three affected branches.
OpenBao's unauthenticated root-token generation and rekey endpoints can complete operations without a corresponding response audit record when request audit logging succeeds but response audit logging fails, reducing forensic visibility. OpenBao versions before 2.6.4 and 2.7.x before 2.7.1 are affected, but the impacted endpoints are disabled by default since OpenBao 2.5.3 and must be explicitly enabled for exploitation. No public exploit identified at time of analysis, and the issue is a low-severity logging gap rather than a path to secret disclosure or modification.
Silent suppression of Windows event-log records in Apache log4net's EventLogAppender lets a party that can influence logged content erase a whole event record without any error being raised. Applications on Windows that use EventLogAppender in log4net 1.2.9 through versions before 3.5.0 are affected: messages are truncated to a hard-coded 31,837-character ceiling that exceeds the real Event Log record budget once the log name, source name, and machine name are counted, so the service silently stores and reports nothing for the oversized record. No public exploit identified at time of analysis, and the independent assessment rates this a genuine but low-priority, niche-configuration issue (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), since an attacker must be able to push a single logged message into the tens-of-kilobytes range.
Authenticated remote users of IBM Financial Transaction Manager (FTM) for Red Hat OpenShift can forge entries in the transaction audit log by supplying a crafted HTTP header that the application fails to validate properly. Successful abuse requires only valid low-privilege credentials (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), so the practical consequence is limited to the integrity of the audit trail - no data disclosure, no service disruption, and no unauthenticated attack path. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided; combined with the narrow, specialized deployment footprint of the platform, this is a genuinely low-priority issue whose signals are consistent rather than conflicting.
Failed authentication attempts against MISP 2.5.45 and earlier stop being written to the audit log whenever the Redis instance used for log throttling is unreachable, and they remain unwritten for the entire duration of the outage. The flaw is in AppController::_shouldLog(), which treats 'Redis returned false' as 'nothing to log' rather than degrading to verbose logging, so brute-force or credential-stuffing activity against the login endpoint silently disappears from the record. No public exploit code and no CISA KEV entry exist for this issue, and the vendor shipped a fix in MISP 2.5.46 via commit a39b25d2f.
MISP 2.5.45 and earlier can write corrupted access-log records for any HTTP request that ends in an unhandled exception, because CakePHP's CakeErrorController extends AppController and re-runs the application startup path, causing AccessLog::logRequest() to register a second deferred writer that overwrites the row written by the first pass. The overwritten fields include request duration, SQL query count, memory usage and potentially the query log, silently degrading the fidelity of MISP's own audit trail. Exploitation requires an authenticated session (CVSS 4.0 PR:L, VI:L only); no public exploit code or CISA KEV listing was identified at time of analysis, and an upstream fix commit (0dae5c072) is available.