Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
641 results · Clear filters · Feed
-
Medium 4.9
Unnecessary data is written to log if issues during indexing occurs
Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
-
Medium 6.5
Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encr…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 a…
-
Medium 4.3
Server Response Disclosure in RapidDiag Salesforce.com Log File
In Splunk Enterprise versions below 9.0.8, the Splunk RapidDiag utility discloses server responses from external applications in a log file.
-
Medium 5.3
DependencyCheck Debug Mode Logging of NVD API Key
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
-
Medium 4.4
Insertion of Sensitive Information into Log File in react-native-mmkv
react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv logged the optional encryption key for the MMKV database into the Android system log. The key can be obtained by anyone …
-
Medium 5.3
WordPress WP Optin Wheel Plugin <= 1.4.3 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress a…
-
Medium 5.3
WordPress Defender Security Plugin <= 4.1.0 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
-
Medium 5.3
WordPress Database Cleaner Plugin <= 0.9.8 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.
-
Medium 5.3
WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.
-
Medium 4.8
CubeFS leaks users key in logs
CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a l…
-
Medium 6.8
Elastic Agent Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the event tha…
-
Medium 6.8
Beats Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsearch failed with any 4xx HTTP status code except 409 or 429. Depending on the nature of the…
-
Medium 6.8
Enterprise Search Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the contents of such documents, this could lead to the insertion of sensitive or private information in the…
-
Medium 4.0
Information leak in nodejs-firestore
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend u…
-
Medium 5.0
Insertion of Sensitive Information into Log in codeigniter4/shield
CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they c…
-
Medium 6.2
IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 247034.
-
Medium 5.5
Insertion of sensitive information into log file in some Intel(R) On Demand software before versions 1.16.2, 2.1.1, 3.1…
-
Medium 4.5
Secret logging may occur in debug mode of Atlas Operator
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6…
-
Medium 4.2
`SPICEDB_DATASTORE_CONN_URI` is leaked when URI cannot be parsed
SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1, when the provided datastore URI is malformed (e.g. by having a password which contains `:`) the full…
-
Medium 4.1
Elasticsearch Insertion of sensitive information in audit logs
Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that se…
-
Medium 4.6
Elastic Endpoint Insertion of Sensitive Information into Log File
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API…
-
Medium 4.4
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma…
-
Medium 6.5
Apache Santuario: Private Key disclosure in debug-log output
All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level i…
-
Medium 5.5
Token in custom credentials object can leak through logs in ydb-go-sdk
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object could be serialized i…
-
Medium 4.4
IBM App Connect Enterprise information disclosure
IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive information from API logs. IBM X-Force ID: 263833.
-
Medium 5.5
An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker …
-
Medium 5.5
BIGIP and BIG-IQ TACACS+ audit log Vulnerability
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.5
BIG-IP DNS TSIG Key vulnerability
When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 4.4
BIG-IP APM Guided Configuration vulnerability
When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
-
Medium 5.5
Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could us…
-
Medium 4.4
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (L…
-
Medium 6.3
Platform: token exposed at importing project
A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality…
-
Medium 6.5
Information Exposure Vulnerability in Hitachi Ops Center Administrator
Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users to gain sensitive information.This issue affects Hitachi Ops Center Administrator: before 10.9.3-00.
-
Medium 4.4
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Win…
-
Medium 6.7
QVR Pro Client
An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local authenticated administrators with an additional, less-protected path to acquiring the information vi…
-
Medium 5.3
Improper masking of credentials in Jenkins Pipeline Maven Integration Plugin
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret" is checked.
-
Medium 4.4
Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows…
-
Medium 4.2
Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application
Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.…
-
Medium 4.0
Improper log output when using GitHub Status Notifications in spinnaker
Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that th…