Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
1,027 results · Feed
-
High 8.0
smartCARS 3 Password Stored as plain text in Error Log
smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensu…
-
Medium 5.5
Spring Vault vulnerable to insertion of sensitive information into a log file
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
-
Medium 4.0
Sensitive information exposure in the logs of greader API in FreshRSS
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where the authentication fails. The issues occurs in `authorizationToUser()` in `greader.php`. If there is…
-
Low 3.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monter…
-
Medium 6.2
IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local use…
-
Medium 6.8
Plaintext Password Present in the Web logs
Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug. Users should upgrade to Meridian 2023.1.0 or newer, …
-
Medium 6.5
IBM Spectrum Virtualize information disclosure
IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540.
-
Medium 4.1
An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0…
-
High 7.5
SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a cred…
-
Medium 6.3
Argo CD leaks repository credentials in user-facing error messages and in logs
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the use…
-
High 8.6
Sensitive Information leak via Script File in TinaCMS
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext …
-
Medium 6.5
Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syft
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PAS…
-
High 7.5
Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path i…
-
High 8.7
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in ce…
-
High 7.9
Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in clou…
-
High 8.1
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in pl…
-
High 7.8
Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in chan…
-
Medium 6.1
Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 compon…
-
Medium 5.5
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting fr…
-
Medium 5.5
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" b…
-
Medium 4.2
IBM Cloud Pak for Security information disclosure
IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.
-
Low 2.7
Improper Output Neutralization in Log Module in shopware
Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails. An attacker with access to either the local system logs or a centralized logging store may have acc…
-
Medium 4.3
Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via p…
-
Medium 4.4
Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
-
Medium 5.3
IBM Cognos Analytics information disclosure
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.
-
Medium 4.3
CVE-2022-38756 vulnerability in GW Web prior to 18.4.2
A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTT…
-
Medium 4.7
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This coul…
-
Medium 5.5
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
-
Low 3.5
Authorization header displayed in the debug logs
Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Authorization header in its debug logs. In certain cases, if the log level is set to DEBUG, credentials …
-
High 7.5
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive …
-
Medium 4.7
Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for…
-
Medium 4.2
A component in Foundry logging was found to be capturing sensitive information in logs.
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
-
Medium 4.2
The Foundry Code-Workbooks service was found to contain an issue leading to information disclosure.
Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents th…
-
Medium 5.1
IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be…
-
Low 3.3
Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 al…
-
Medium 4.0
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (W…
-
Medium 4.2
The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests.
The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This vulnerability is resolved in osisoft-pi-web-connector version 0.44.0.
-
High 8.4
Sensitive Information store in NSClient logs
Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be restricted. The vulnerability exists because the sensitive information is not masked/scrubbed before w…
-
Medium 6.5
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained s…
-
Medium 6.5
Information Exposure Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer
Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer probe component) allows local users to gai…