Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
210 results · Clear filters · Feed
-
High 7.5
Renovate before 19.38.7 Credential Exposure via Go Modules
Renovate versions >= 13.87.0 and <= 19.38.6 leak temporary repository tokens into pull request comments during certain Go Modules update failure scenarios. The issue is fixed in version 19.38.7. Anyone able to view the affected pull request comments could obt…
-
High 7.1
The following vulnerabilities that can affect IBM Storage Scale and the Management GUI are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher
IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 Secrets may be disclosed in log files in IBM Storage Scale Management GUI The admin password is logged into the GUI log of IBM Storage Scale Systems Deploy and Upgrade from GUI. Secrets ma…
-
High 7.1
Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-200 ccx response
A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credent…
-
High 7.5
IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes
IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.
-
High 7.4
IBM WebSphere Application Server is affected by an unsafe deserialization and exposure of sensitive information
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
-
High 7.8
Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, versions 9.11.0.0 through 9.13.0.2 contains an Insertion of Se…
-
High 8.1
Frigate viewer can read logs exposing admin and camera credentials
Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user including the viewer role to download Frigate and nginx logs, exposing auto-generated admin passwords and camera credential…
-
High 8.6
Insertion of Sensitive Information into Log File in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.1 that under certain conditions could have allowed a user to access sensitive information that had already been committed to a project, due to insufficient output filteri…
-
High 8.8
Plaintext Log Credential Leakage
System log files output unencrypted SMTP server authentication passwords alongside sensitive employee corporate identification data.
-
High 7.8
A high security vulnerability affecting Security Center main server installations has been identified. It could allow a…
-
High 7.2
Calicoctl leaks cluster credentials to stderr when verbose logging is enabled
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — …
-
High 7.3CVE-2026-32996 Public exploit
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
-
High 8.1
Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Serv…
-
High 7.5
Log Files contain encrypted secrets
Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0.
-
High 7.5
LDAP simple-bind password exposure in log output
Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.
-
High 7.5
Sensitive Information Disclosure through Log Files in Splunk Enterprise
In Splunk Enterprise versions below 10.2.2 and 10.0.5, and Splunk Cloud Platform versions below 10.3.2512.8, 10.2.2510.11, 10.1.2507.21, and 10.0.2503.13, a user with a role that has access to the `_internal` index could view session cookies and response bodi…
-
High 7.6
Valtimo: Sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer
Valtimo is an open-source business process automation platform. From 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body,…
-
High 7.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26…
-
High 8.8
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 1…
-
High 7.5
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26…
-
High 8.3
HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of se…
-
High 7.5CVE-2025-67223 Public exploit
The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs …
-
High 8.7
Oxia: Bearer token exposed in debug log messages on authentication failure
Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in plaintext. If debug logging is enabled in production, JWT tokens are exposed in application logs and any conne…
-
High 7.6
Dell PowerProtect Data Domain appliances with Data Domain Operating System (DD OS) of Feature Release versions 8.0 thro…
-
High 7.5
Meridian: Multiple defense-in-depth gaps (collection/depth caps, telemetry, retry, fan-out)
## Summary Meridian v2.1.0 (`Meridian.Mapping` and `Meridian.Mediator`) shipped with nine defense-in-depth gaps reachable through its public APIs. Two are HIGH severity — the advertised `DefaultMaxCollectionItems` and `DefaultMaxDepth` safety caps are silentl…
-
High 7.5
Apache Airflow: JWT token appearing in logs
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix. Users are recommended to upgrade to version 3.2.0, which fixes this issue.
-
High 7.2
Sensitive Information Disclosure in ''_internal'' index in Splunk MCP Server app
In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnera…
-
High 8.5
Sensitive Information Logging Vulnerability in FlashBlade
A vulnerability exists in FlashBlade whereby sensitive information may be logged under specific conditions.
-
High 7.5
Apache Airflow: Secrets from Airflow config file logged in plain text in DAG run logs UI
Before Airflow 3.2.0, it was unclear that secure Airflow deployments require the Deployment Manager to take appropriate actions and pay attention to security details and security model of Airflow. Some assumptions the Deployment Manager could make were not cl…
-
High 7.5
Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token
Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…
-
High 7.8
Dell Elastic Cloud Storage, version 3.8.1.7 and prior, and Dell ObjectScale, versions prior to 4.1.0.3 and version 4.2.…
-
High 8.4
Multiple Vulnerabilities affect IBM Tivoli Netcool Impact
IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user.
-
High 8.7
HAX CMS's public /server-status endpoint exposes authentication tokens, user activity, and client IP addresses
HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client IP addresses, and se…
-
High 7.5
OpenClaw < 2026.3.13 - Telegram Bot Token Exposure in Media Fetch Error Logs
OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in Me…
-
High 7.5
OpenClaw < 2026.3.12 - Long-lived Credential Exposure in Pairing Setup Codes
OpenClaw before 2026.3.12 embeds long-lived shared gateway credentials directly in pairing setup codes generated by /pair endpoint and OpenClaw qr command. Attackers with access to leaked setup codes from chat history, logs, or screenshots can recover and reu…
-
High 7.3
Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in the SCIM Driver module in OpenText IDM Driver and Extensions on Windows, Linux, 64 bit allows authenticated local users to obtain sensitive information via access to log files. This issue affec…
-
High 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…
-
High —
Curio exposes database credentials to users with network access through verbose HTTP error responses
## Summary Multiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string — including hostname, port, usern…
-
High 7.8
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
-
High 8.7
PlaciPy Exposes Sensitive Data via Application Logs
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.