cve.bz

CWE-532: Insertion of Sensitive Information into Log File, page 13

Filter

The product writes sensitive information to a log file.

What the weakness is: CWE-532 at MITRE

Ask an AI about CWE-532

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-532: Insertion of Sensitive Information into Log File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/532.html and https://cve.bz/cve/cwe/532?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2024-22339EPSS 0.4%

    IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 is vulnerable to a sensitive information due to insufficient obfuscation of sensitiv…

  2. 6.5CVE-2024-31391EPSS 0.8%

    Insertion of Sensitive Information into Log File vulnerability in the Apache Solr Operator. This issue affects all versions of the Apache Solr Operator from 0.3.0 through 0.8.0. When asked to bootstrap Solr security, the operator will en…

  3. 5.3CVE-2024-31353EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.

  4. 7.5CVE-2024-31298EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.

  5. 7.5CVE-2024-31259EPSS 0.6%

    Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5.

  6. 7.5CVE-2024-31254EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.

  7. 7.5CVE-2024-31249EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.

  8. 7.5CVE-2024-31247EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.

  9. 7.5CVE-2024-31245EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5.

  10. 5.3CVE-2024-2302EPSS 0.6%

    The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possible…

  11. 5.5CVE-2024-25030EPSS 0.2%

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281677.

  12. 4.5CVE-2024-3165EPSS 0.5%

    System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by…

  13. 5.3CVE-2024-30523EPSS 0.4%

    Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.

  14. 5.3CVE-2024-30514EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.

  15. 5.3CVE-2024-30511EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.

  16. 5.5CVE-2024-25959EPSS 0.2%

    Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to sensitive informati…

  17. 5.3CVE-2024-25923EPSS 0.4%

    Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.

  18. 5.3CVE-2024-22138EPSS 0.4%

    Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: from n/a through 2.20.47.

  19. 7.2CVE-2024-29945EPSS 0.9%

    In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebT…

  20. 7.5CVE-2023-44989EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5.

  21. 5.5CVE-2024-25957EPSS 0.2%

    Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module. An authenticated local attacker could potentially exploit this vulnerability, leading to informatio…

  22. 9.9CVE-2022-36407EPSS 0.5%

    Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Vir…

  23. 7.1CVE-2024-24272EPSS 0.2%

    An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of …

  24. 5.5CVE-2024-22352EPSS 0.5%

    IBM InfoSphere Information Server 11.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 280361.

  25. 5.5CVE-2024-25654EPSS 0.2%

    Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensit…

  26. 3.3CVE-2023-27502EPSS 0.2%

    Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow an authenticated user to potentially enable information disclosure via local access.

  27. 5.3CVE-2024-27097EPSS 0.4%

    A user endpoint didn't perform filtering on an incoming parameter, which was added directly to the application log. This could lead to an attacker injecting false log entries or corrupt the log file format. This has been fixed in the CKAN …

  28. 5.5CVE-2023-43043EPSS 0.2%

    IBM Maximo Application Suite - Maximo Mobile for EAM 8.10 and 8.11 could disclose sensitive information to a local user. IBM X-Force ID: 266875.

  29. 6.5CVE-2024-28236EPSS 0.7%

    Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Vela pipelines can use variable substitution combined with insensitive fields like `parameters`, `image` and `entrypoint` to inject secr…

  30. 7.1CVE-2024-28186EPSS 0.6%

    FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the app…

  31. 5.6CVE-2023-6814EPSS 0.2%

    Insertion of Sensitive Information into Log File vulnerability in Hitachi Cosminexus Component Container allows local users to gain sensitive information.This issue affects Cosminexus Component Container: from 11-30 before 11-30-05, from 1…

  32. 3.3CVE-2024-23242EPSS 0.2%

    A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to view Mail data.

  33. 4.3CVE-2023-46171EPSS 0.4%

    IBM DS8900F HMC 89.21.19.0, 89.21.31.0, 89.30.68.0, 89.32.40.0, and 89.33.48.0 could allow an authenticated user to view sensitive log information after enumerating filenames. IBM X-Force ID: 269408.

  34. 6.5CVE-2024-28154EPSS 0.7%

    Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default.

  35. 5.3CVE-2023-50740EPSS 0.9%

    In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module.  We recommend users upgrade the version of Linkis to version 1.5.0

  36. 7.5CVE-2024-23758EPSS 0.5%

    An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.

  37. 5.5CVE-2024-22337EPSS 0.2%

    IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279977.

  38. 5.5CVE-2024-22336EPSS 0.2%

    IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279976.

  39. 5.5CVE-2024-22335EPSS 0.2%

    IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 279975.

  40. 4.3CVE-2023-50951EPSS 0.4%

    IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747.

  41. 2.7CVE-2024-23760EPSS 0.4%

    Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot.

  42. 7.5CVE-2023-47131EPSS 0.5%

    The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.

  43. 6.8CVE-2024-22464EPSS 0.5%

    Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerability in AppSync server logs. A high privileged remote attacker could potentially exploit this vul…

  44. 7.5CVE-2024-23448EPSS 0.7%

    An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the …

  45. 5.3CVE-2024-24939EPSS 0.3%

    In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible

  46. 7.5CVE-2024-0935EPSS 0.4%

    Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024

  47. 6.5CVE-2024-0831EPSS 0.8%

    Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured…

  48. 5.5CVE-2024-23840EPSS 0.3%

    GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerabil…

  49. 7.2CVE-2023-46231EPSS 0.5%

    In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.

  50. 4.9CVE-2023-46230EPSS 0.4%

    In Splunk Add-on Builder versions below 4.1.4, the app writes sensitive information to internal log files.