CWE-532: Insertion of Sensitive Information into Log File, page 18
Filter
The product writes sensitive information to a log file.
What the weakness is: CWE-532 at MITRE
Ask an AI about CWE-532
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-532: Insertion of Sensitive Information into Log File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/532.html and https://cve.bz/cve/cwe/532?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 7.5CVE-2022-38149EPSS 0.8%
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.2…
- 5.5CVE-2022-20278EPSS 0.1%
In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede…
- 4.3CVE-2022-31674EPSS 0.7%
VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.
- 5.3CVE-2022-38133EPSS 0.5%
In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
- 5.5CVE-2022-29071EPSS 0.2%
This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of conditions, user passwords can be leaked in the Audit and System logs. The impact…
- 4.9CVE-2022-31119EPSS 0.8%
Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the event of a misconfiguration. Should an attacker gain access to the logs complete a…
- 3.3CVE-2022-31186EPSS 0.3%
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive …
- 7.5CVE-2022-34570EPSS 1.0%
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
- 7.5CVE-2022-32556EPSS 1.0%
An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.
- 6.5CVE-2022-36321EPSS 1.9%
In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases
- 3.5CVE-2022-2394EPSS 0.5%
Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
- 7.5CVE-2022-23141EPSS 0.8%
ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive info…
- 5.9CVE-2022-34826EPSS 0.6%
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
- 5.3CVE-2022-33911EPSS 1.0%
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
- 3.3CVE-2022-33697EPSS 0.10%
Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
- 2.3CVE-2022-33693EPSS 0.10%
Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log.
- 3.3CVE-2022-33688EPSS 0.10%
Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
- 3.3CVE-2022-33687EPSS 0.10%
Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log.
- 5.5CVE-2022-27549EPSS 0.1%
HCL Launch may store certain data for recurring activities in a plain text format.
- 4.9CVE-2022-20768EPSS 1.0%
A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerabil…
- 7.5CVE-2022-33737EPSS 0.9%
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password
- 7.5CVE-2022-31098EPSS 1.3%
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to vie…
- 5.5CVE-2022-20651EPSS 0.4%
A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shar…
- 5.5CVE-2022-30148EPSS 1.2%
Windows Desired State Configuration (DSC) Information Disclosure Vulnerability
- 6.5CVE-2022-31047EPSS 1.1%
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception h…
- 7.5CVE-2022-32254EPSS 0.8%
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information th…
- 7.5CVE-2022-32565EPSS 1.2%
An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids.
- 6.5CVE-2022-32193EPSS 0.8%
Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor.
- 3.3CVE-2022-30742EPSS 0.2%
Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sim card information through device log.
- 3.3CVE-2022-30741EPSS 0.2%
Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to get sim card information through device log.
- 5.3CVE-2022-30733EPSS 0.6%
Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.
- 6.8CVE-2021-43271EPSS 0.9%
Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use local, RADIUS, or TACACS authentication) logs usernames and passwords if either is …
- 6.5CVE-2022-20807EPSS 1.0%
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive i…
- 7.1CVE-2022-20806EPSS 1.0%
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive i…
- 6.5CVE-2022-20809EPSS 1.0%
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive i…
- 4.9CVE-2022-29928EPSS 0.5%
In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible
- 5.5CVE-2022-28161EPSS 0.2%
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode…
- 6.5CVE-2022-28859EPSS 0.8%
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versi…
- 5.5CVE-2022-27636EPSS 0.2%
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions…
- 5.3CVE-2022-29869EPSS 1.9%
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
- 5.3CVE-2021-38939EPSS 0.8%
IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.
- 5.5CVE-2022-29810EPSS 0.4%
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
- 5.5CVE-2022-27888EPSS 0.2%
Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.
- 7.5CVE-2022-24875EPSS 1.0%
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` a…
- 5.3CVE-2022-26907EPSS 2.4%
Azure SDK for .NET Information Disclosure Vulnerability
- 2.4CVE-2022-1157EPSS 0.6%
Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potential sensitive values in invalid URLs to be logged
- 8.1CVE-2021-45103EPSS 0.9%
An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked HTCondor to transfer.
- 7.5CVE-2022-27442EPSS 1.0%
TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.
- 7.5CVE-2022-24758EPSS 1.1%
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other …
- 3.3CVE-2021-39739EPSS 0.1%
In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…