CWE-532: Insertion of Sensitive Information into Log File, page 19

The product writes sensitive information to a log file.

What the weakness is: CWE-532 at MITRE

1. 7.5CVE-2022-27192EPSS 1.1%2022-03-23

   The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.

2. 7.5CVE-2022-24757EPSS 1.3%2022-03-23

   The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is…

3. 6.5CVE-2022-25518EPSS 0.8%2022-03-22

   In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of the users who login to the application by querying the database table.

4. 7.8CVE-2022-0652EPSS 0.2%2022-03-22

   Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before v…

5. 4.4CVE-2021-39715EPSS 0.1%2022-03-16

   In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed…

6. 5.5CVE-2021-20180EPSS 0.3%2022-03-16

   A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_p…

7. 3.3CVE-2022-25830EPSS 0.2%2022-03-10

   Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp in the log

8. 3.3CVE-2022-25829EPSS 0.2%2022-03-10

   Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp in the log

9. 3.3CVE-2022-25828EPSS 0.2%2022-03-10

   Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log

10. 3.3CVE-2022-25827EPSS 0.2%2022-03-10

    Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp in the log

11. 3.3CVE-2022-25826EPSS 0.2%2022-03-10

    Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in the log

12. 3.3CVE-2022-25823EPSS 0.2%2022-03-10

    Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log.

13. 7.5CVE-2022-0725EPSS 2.8%2022-03-10

    A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.

14. 6.5CVE-2021-41543EPSS 0.7%2022-03-08

    A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling of log files in the web application of affected devices contains an information…

15. 5.3CVE-2021-25009EPSS 1.2%2022-03-07

    The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses

16. 7.5CVE-2022-25374EPSS 1.0%2022-02-25

    HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.

17. 4.4CVE-2022-20630EPSS 0.2%2022-02-10

    A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerability is due to the unsecured logging of sensitive information on an affected syste…

18. 5.5CVE-2022-0021EPSS 0.2%2022-02-10

    An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon fe…

19. 4.9CVE-2022-22939EPSS 0.8%2022-02-04

    VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Manager. A malicious actor with root access on VMware Cloud Foundation SDDC Manager …

20. 7.8CVE-2021-36289EPSS 0.2%2022-01-25

    Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.

21. 4.3CVE-2022-0338EPSS 0.8%2022-01-25

    Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.

22. 2.3CVE-2021-41808EPSS 0.2%2022-01-18

    In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mitigating factors are logging is disabled by default.

23. 5.5CVE-2022-22703EPSS 0.2%2022-01-17

    In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.

24. 5.5CVE-2021-44234EPSS 0.2%2022-01-14

    SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

25. 5.5CVE-2021-39032EPSS 0.3%2022-01-14

    IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 213962.

26. 5.5CVE-2021-45449EPSS 0.4%2022-01-12

    Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged i…

27. 7.5CVE-2021-45034EPSS 2.3%2022-01-11

    A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < V16.20), CP-8021 MASTER MODULE (All versions < V16.20), CP-8022 MASTER MODULE…

28. 7.5CVE-2021-34797EPSS 2.6%2022-01-04

    Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the pr…

29. 6.7CVE-2021-36318EPSS 0.2%2021-12-21

    Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vulnerability, leading to a complete outage.

30. 5.5CVE-2021-0997EPSS 0.1%2021-12-15

    In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User…

31. 2.4CVE-2021-0991EPSS 0.2%2021-12-15

    In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution pri…

32. 7.5CVE-2021-37861EPSS 0.9%2021-12-09

    Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails.

33. 7.5CVE-2021-34800EPSS 1.0%2021-11-29

    Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147

34. 5.5CVE-2021-21561EPSS 0.2%2021-11-23

    Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE privileges to gain access to sensitive information in the …

35. 5.5CVE-2021-37036EPSS 0.2%2021-11-23

    There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs i…

36. 5.5CVE-2021-36340EPSS 0.3%2021-11-20

    Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.

37. 6.5CVE-2021-22030EPSS 1.0%2021-11-19

    In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs of the database. A malicious user with access to logs can read sensitive(creden…

38. 4.4CVE-2021-27026EPSS 0.2%2021-11-18

    A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged

39. 4.4CVE-2021-0148EPSS 0.2%2021-11-17

    Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information disclosure via local access.

40. 6.5CVE-2021-3791EPSS 0.4%2021-11-12

    An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same subnet to download an encrypted log file containing sensitive information such a…

41. 5.5CVE-2021-40364EPSS 0.2%2021-11-09

    A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIM…

42. 5.5CVE-2020-10052EPSS 0.2%2021-11-09

    A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames and passwords in log files. A local attacker with access to the log files could …

43. 6.7CVE-2021-39913EPSS 0.3%2021-11-05

    Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, and all versions starting from 14.4 before 14.4.1 allows an attacker with local f…

44. 7.5CVE-2021-20129EPSS 1.7%2021-10-13

    An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs.

45. 2.7CVE-2021-39900EPSS 0.6%2021-10-04

    Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availability via Rails logs.

46. 6.1CVE-2021-39246EPSS 0.5%2021-09-24

    Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be abl…

47. 4.9CVE-2021-23046EPSS 0.8%2021-09-14

    On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configuration (AGC), secure properties are logged in restnoded logs. Note: Software versi…

48. 9.9CVE-2021-32724EPSS 2.3%2021-09-09

    check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.com/marketplace/actions/check-spelling) enabled that triggers on `pull_request_ta…

49. 5.5CVE-2021-32801EPSS 0.2%2021-09-07

    Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommende…

50. 4.9CVE-2021-27022EPSS 0.9%2021-09-07

    A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should not be. This issue only affects SSH/WinRM nodes (inventory service nodes).