CWE-532: Insertion of Sensitive Information into Log File, page 27

The product writes sensitive information to a log file.

What the weakness is: CWE-532 at MITRE

1. 7.8CVE-2017-5153EPSS 0.4%2017-02-13

   An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has …

2. 7.5CVE-2016-9344EPSS 1.6%2017-02-13

   An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.

3. 7.5CVE-2016-8346EPSS 2.1%2017-02-13

   An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION).

4. 5.5CVE-2017-5549EPSS 0.4%2017-02-06

   The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log entry upon a failure to read the line status, which allows local users to obtain …

5. 6.2CVE-2017-5137EPSS 1.0%2017-02-05

   An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspective.

6. 4.3CVE-2016-8912EPSS 0.9%2017-02-01

   IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user.

7. 3.3CVE-2016-0296EPSS 0.3%2017-02-01

   IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.

8. 7.5CVE-2015-8977EPSS 2.2%2017-01-31

   MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.

9. 7.5CVE-2016-9882EPSS 1.7%2017-01-13

   An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the credentials returned from service brokers in Cloud Controller system component logs. T…

10. 5.5CVE-2016-4443EPSS 0.2%2016-12-14

    Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the engine-setup log file.

11. 1.9CVE-2016-2943EPSS 0.3%2016-11-30

    IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file.

12. 4.3CVE-2016-2928EPSS 1.0%2016-11-25

    IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs.

13. 5.5CVE-2016-5967EPSS 0.3%2016-11-25

    The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native logs.

14. 3.3CVE-2016-5432EPSS 0.3%2016-10-03

    The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.

15. 7.5CVE-2016-0879EPSS 2.2%2016-05-31

    Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote attackers to obtain sensitive information by requesting these files at an unspe…

16. 7.5CVE-2016-0875EPSS 1.8%2016-05-31

    Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL.

17. –CVE-2013-6384EPSS 0.4%2013-11-23

    (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 o…

18. 7.5CVE-2013-4733EPSS 2.2%2013-06-30

    The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attackers to obtain sensitive configuration and status information by reading log file…

19. 6.5CVE-2012-0814EPSS 3.6%2012-01-27

    The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by read…

20. –CVE-2011-1943EPSS 0.2%2011-06-14

    The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containing a certificate password, which allows local users to obtain sensitive informat…

21. –CVE-2001-1556EPSS 3.6%2001-12-31

    The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewe…