Skip to content
OpenAdvisories

Weakness (CWE)

CWE-532: Insertion of Sensitive Information into Log File

Base Incomplete

The product writes sensitive information to a log file.

How to prevent it (4 mitigations)

  1. Architecture and Design, Implementation

    Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

  2. Distribution

    Remove debug log files before deploying the application into production.

  3. Operation

    Protect log files against unauthorized read/write.

  4. Implementation

    Adjust configurations appropriately when software is transitioned from a debug state to production.

Source: MITRE CWE-532

All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-22778 Public exploit EPSS 18%

    vLLM leaks a heap address when PIL throws an error

    vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this l…

    vllm-project vLLM vllm PyPI
  • Critical 9.0
    CVE-2025-63729 Public exploit

    An issue was discovered in Syrotech SY-GPON-1110-WDONT SYRO_3.7L_3.1.02-240517 allowing attackers to exctract the SSL P…

  • Critical 9.4
    CVE-2024-48852 Public exploit

    Information disclosures

    Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

    ABB FLXEON ICS / OT
  • Critical 9.9
    CVE-2023-40029 Public exploit

    Cluster secret might leak in cluster details page in Argo CD

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Critical 9.9
    CVE-2021-32724 Public exploit

    check-spelling workflow vulnerable to GITHUB_TOKEN leakage via symlink attack

    check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_target` (or `schedule`…

    check-spelling check-spelling check-spelling/check-spelling GitHub Actions