cve.bz

CWE-532: Insertion of Sensitive Information into Log File, page 10

Filter

The product writes sensitive information to a log file.

What the weakness is: CWE-532 at MITRE

Ask an AI about CWE-532

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-532: Insertion of Sensitive Information into Log File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/532.html and https://cve.bz/cve/cwe/532?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2024-48852ExploitEPSS 2.5%

    Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.

  2. 5.5CVE-2025-0736EPSS 0.2%

    A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure c…

  3. 7.5CVE-2025-24169EPSS 0.8%

    A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.

  4. 3.3CVE-2025-24145EPSS 0.2%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An app may be able to view a contact's phone number in system logs.

  5. 5.5CVE-2024-54519EPSS 0.2%

    The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read sensitive location information.

  6. 6.3CVE-2025-24389EPSS 0.1%

    Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTR…

  7. 6.5CVE-2023-38271EPSS 0.3%

    IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.

  8. 7.1CVE-2025-24362EPSS 1.2%

    In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to…

  9. 3.2CVE-2025-24034EPSS 0.2%

    Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled…

  10. 5.5CVE-2025-24457EPSS 0.6%

    In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs

  11. 5.5CVE-2024-45091EPSS 0.2%

    IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

  12. 5.5CVE-2024-11923EPSS 0.2%

    Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3

  13. 6.5CVE-2024-12226EPSS 0.4%

    In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieve…

  14. 5.3CVE-2024-55891EPSS 0.3%

    TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised …

  15. 5.5CVE-2025-21323EPSS 0.9%

    Windows Kernel Memory Information Disclosure Vulnerability

  16. 5.5CVE-2025-21321EPSS 1.0%

    Windows Kernel Memory Information Disclosure Vulnerability

  17. 5.5CVE-2025-21320EPSS 1.0%

    Windows Kernel Memory Information Disclosure Vulnerability

  18. 5.5CVE-2025-21319EPSS 1.0%

    Windows Kernel Memory Information Disclosure Vulnerability

  19. 5.5CVE-2025-21318EPSS 1.0%

    Windows Kernel Memory Information Disclosure Vulnerability

  20. 5.5CVE-2025-21317EPSS 0.9%

    Windows Kernel Memory Information Disclosure Vulnerability

  21. 5.5CVE-2025-21316EPSS 1.0%

    Windows Kernel Memory Information Disclosure Vulnerability

  22. 5.5CVE-2024-40679EPSS 0.2%

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.

  23. 9.3CVE-2025-22275EPSS 0.5%

    iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, d…

  24. 5.2CVE-2024-12569EPSS 0.1%

    Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions.

  25. 4.4CVE-2024-49816EPSS 0.4%

    IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.

  26. 4.0CVE-2024-12292EPSS 0.2%

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have…

  27. 5.5CVE-2024-54484EPSS 0.2%

    The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data.

  28. 8.5CVE-2024-42407EPSS 0.3%

    Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted acce…

  29. 1.8CVE-2024-12057EPSS 0.1%

    User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker cou…

  30. 4.3CVE-2024-55578EPSS 0.3%

    Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files.

  31. 5.5CVE-2024-42196EPSS 0.2%

    HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.

  32. 5.7CVE-2024-47094EPSS 0.2%

    Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be written to web log files accessible to local site users.

  33. 6.9CVE-2024-52067EPSS 0.7%

    Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enab…

  34. 5.5CVE-2022-43937EPSS 0.5%

    Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Brocade SANnav before 2.3.0 and 2.2.2a

  35. 4.9CVE-2022-43936EPSS 0.8%

    Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled.

  36. 4.4CVE-2022-43935EPSS 0.2%

    An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and authorization IDs are printed in the embedded MLS DB file.

  37. 4.4CVE-2022-43933EPSS 0.3%

    An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supportsave. Supportsave file is generated by an admin user troubleshooting the switch. …

  38. 7.5CVE-2024-52940EPSS 1.3%

    AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.

  39. 5.0CVE-2024-11193EPSS 0.3%

    An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw results in the unintentional exposure of sensitive information in Yugabyte Anywhere…

  40. 5.7CVE-2024-11165EPSS 0.1%

    An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exp…

  41. 8.5CVE-2024-52009EPSS 0.7%

    Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs …

  42. 2.1CVE-2024-51753EPSS 0.2%

    The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions refresh tokens are logged to the console when the disabled by default `debug` flag,…

  43. 2.1CVE-2024-51752EPSS 0.2%

    The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions refresh tokens are logged to the console when the disabled by default `debug` f…

  44. 5.5CVE-2024-51528EPSS 0.1%

    Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  45. 5.3CVE-2024-10544EPSS 0.5%

    The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly exposed log files. This makes it possible for unauthenticated attackers to view p…

  46. 5.5CVE-2024-44239EPSS 0.3%

    An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.…

  47. 3.3CVE-2024-27849EPSS 0.2%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive location information.

  48. 5.5CVE-2024-49750EPSS 0.2%

    The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, th…

  49. 5.5CVE-2024-44205EPSS 0.2%

    A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A sandboxed …

  50. 8.4CVE-2023-22649ExploitEPSS 2.0%

    A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log) is an opt…