Threats Tagged 'cwe-532'

vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.23.1rc0, the fix for CVE-2026-22778, which introduced a sanitize_message helper that strips object-repr memory addresses from error messages before they reach the client, is incomplete: several response paths echo str(exc) directly to clients without calling sanitize_message. The unsanitized sites include the Anthropic API router in vllm/entrypoints/anthropic/api_router.py (the POST /v1/messages and POST /v1/messages/count_tokens handlers), the Server-Sent Events streaming converter in vllm/entrypoints/anthropic/serving.py, and the realtime speech-to-text WebSocket in vllm/entrypoints/speech_to_text/realtime/connection.py. These paths catch the exception inside the route coroutine and construct the JSONResponse themselves, bypassing the sanitizing global FastAPI exception handler, and WebSocket frames do not traverse that handler chain at all. Using the same primitive as the parent issue, an unauthenticated attacker can send malformed image bytes through the Anthropic Messages API image content parts so that PIL.Image.open raises an UnidentifiedImageError whose message contains the BytesIO object repr, leaking the heap memory address verbatim in the error.message field of the response body. This vulnerability is fixed in 0.23.1rc0.

An information exposure vulnerability in the Palo Alto Networks GlobalProtect app on macOS enables a local user to learn the configured passcodes for disabling, disconnecting, or uninstalling the GlobalProtect app. After the passcode is known, the user can perform these actions even if the GlobalProtect app configuration would not normally permit them to do so.

CVE-2026-9751 is a vulnerability in MongoDB Server where the ldapQueryPassword parameter, when set via the runtime setParameter command, is logged in plain text to the mongod.log file. This exposure of sensitive information in logs can lead to unauthorized disclosure of LDAP passwords. The issue affects MongoDB Server versions 7.0.0, 8.0.0, 8.2.0, and 8.3.0. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.8. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

MongoDB server may log authentication parameters, including credentials, to the server log during SASL authentication. When connection health metric logging is enabled, the full authentication parameters are written to the log without redaction.

A vulnerability in fabric-chaincode-java versions 2.3.1 up to but not including 2.5.10 causes the TLS private key password to be logged in plaintext at INFO level when chaincode is deployed in chaincode-as-a-service mode with TLS enabled. This exposure could allow an attacker with access to the logs to recover the password and potentially impersonate the chaincode server if they also obtain the TLS private key. The issue is fixed in version 2.5.10.

Acer Connect M6E 5G Portable WiFi Router logs sensitive information including unencrypted SMTP server authentication passwords and employee corporate identification data in system log files. This vulnerability can lead to exposure of confidential credentials and personal data if logs are accessed by unauthorized parties. The issue is classified under CWE-532, indicating insertion of sensitive information into log files. No patch or official remediation has been confirmed at this time.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, OBI exports raw Redis error text as the span status message. Because Redis error replies can contain attacker-controlled or sensitive values, this behavior can exfiltrate tokens, PII, or other confidential input into telemetry backends and inject untrusted text into downstream analysis systems. This issue has been patched in version 0.9.0.

A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number. Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.

Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: before v2.0.0.