Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
1,024 results · Feed
-
Medium 4.9
IBM Security Guardium Key Lifecycle Manager information disclosure
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.
-
Medium 4.0
Insertion of Sensitive Information into Log File in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in Gr…
-
High 8.5
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature co…
-
Low 1.8
User credentials recorded in log files
User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the cred…
-
Medium 4.3
Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log …
-
Medium 6.2
HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability
HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.
-
Medium 5.7
Logging of sitesecret to automations log
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.
-
Medium 6.9
Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log
Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for…
-
Medium 5.7
Brocade SANnav Information Disclosure Vulnerability
Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a
-
Medium 6.8
Brocade Fabric OS switch passwords when debugging is enabled
Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.
-
Medium 5.3
Switch passwords and authorization IDs are printed in the embedded MLS DB file
An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorization IDs are printed in the embedded MLS DB file.
-
High 7.5CVE-2024-52940 Public exploit
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address w…
-
Medium 5.0
An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintex…
-
Medium 5.7
An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in…
-
High 8.5
Git credentials are exposed in atlantis logs
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlan…
-
Low 2.1
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs
The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. Thi…
-
Low 2.1
Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix
The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag, is enabled. This is…
-
Medium 4.0
Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerab…
-
Medium 5.3
Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files
The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 5.5
An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed…
-
Medium 5.5
Snowflake Connector for Python has sensitive data in logs
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could ha…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 a…
-
High 8.4
Rancher 'Audit Log' leaks sensitive information
A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt-in feature, only de…
-
Medium 5.1
SNMP and IMPI secrets written to audit log
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI secrets of host and folder properties to be written to audit log files accessible to administrators.
-
Medium 5.5
Sensitive information in agent log file when detailed logging is enabled with Robot Schedule Enterprise prior to version 3.05
Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enabled.
-
High 8.2
Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure
A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.
-
Medium 4.2
Directus inserts access token from query string into logs
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG…
-
Medium 5.3
Io.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application log
A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, applicat…
-
Medium 5.3
Improper permissions handling in MediaWiki AbuseFilter
An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the l…
-
High 8.8
Improper Access Control in Oceanic Software's ValeApp
Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: before v2.0.0.
-
Medium 4.4
IBM Cloud Pak for Multicloud Management information disclosure
IBM Cloud Pak for Multicloud Management 2.3 through 2.3 FP8 stores user credentials in a log file plain clear text which can be read by a privileged user.
-
Medium 6.5
Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client bef…
-
High 8.8
Power Platform Terraform Provider has Improper Masking of Secrets in Logs
Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the …
-
Medium 5.5
An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers…
-
Medium 5.3
WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 5.5
Ansible-core: exposure of sensitive information in ansible vault files due to improper logging
A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true…
-
Medium 4.0
Insertion of Sensitive Information into Log File in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.