CWE-532: Insertion of Sensitive Information into Log File, page 6
Filter
The product writes sensitive information to a log file.
What the weakness is: CWE-532 at MITRE
Ask an AI about CWE-532
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CWE-532: Insertion of Sensitive Information into Log File and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/532.html and https://cve.bz/cve/cwe/532?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-32598EPSS 0.2%
OneUptime is a solution for monitoring and managing online services. Prior to 10.0.24, the password reset flow logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in …
- 2.4CVE-2026-0520EPSS 0.10%
A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file.
- 6.5CVE-2026-20165EPSS 0.2%
In Splunk Enterprise versions below 10.2.1, 10.0.4, 9.4.9, and 9.3.10, and Splunk Cloud Platform versions below 10.2.2510.7, 10.1.2507.17, 10.0.2503.12, and 9.3.2411.124, a low-privileged user that does not hold the "admin" or "power" Splu…
- 3.3CVE-2026-21791EPSS 0.1%
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL
- 5.3CVE-2025-70040EPSS 0.3%
An issue pertaining to CWE-532: Insertion of Sensitive Information into Log File was discovered in LupinLin1 jimeng-web-mcp v2.1.2. This allows an attacker to obtain sensitive information.
- 6.5CVE-2026-29184EPSS 0.3%
Backstage is an open framework for building developer portals. Prior to version 3.1.4, a malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs. This issue has been p…
- 7.5CVE-2026-24308EPSS 1.2%
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are …
- 3.3CVE-2026-21786EPSS 0.1%
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.
- 4.9CVE-2025-62879EPSS 0.4%
A vulnerability has been identified within the Rancher Backup Operator, resulting in the leakage of S3 tokens (both accessKey and secretKey) into the rancher-backup-operator pod's logs.
- 5.3CVE-2026-1265EPSS 0.2%
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to writing of sensitive Information in a log file.
- 7.7CVE-2025-48635EPSS 0.1%
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User …
- 7.7CVE-2026-27900EPSS 0.5%
The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords, StackScript content, and object storage data in debug logs without redaction. Provider debug logging is not enabled by defaul…
- 7.5CVE-2025-0976EPSS 0.2%
Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.4-00; Hitachi Configuration Manag…
- 5.2CVE-2025-5781EPSS 0.1%
Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager, Hitachi Device Manager allows Session Hijacking.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0…
- 6.5CVE-2025-27555EPSS 0.4%
Airflow versions before 2.11.1 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive connection parameters were set via airflow CLI, value…
- 5.3CVE-2026-2605EPSS 0.3%
Tanium addressed an insertion of sensitive information into log file vulnerability in TanOS.
- 6.5CVE-2026-2350EPSS 0.3%
Tanium addressed an insertion of sensitive information into log file vulnerability in Interact and TDS.
- 6.5CVE-2026-1292EPSS 0.3%
Tanium addressed an insertion of sensitive information into log file vulnerability in Trends.
- 4.9CVE-2026-20144EPSS 0.3%
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.8, and 9.2.11, and Splunk Cloud Platform versions below 10.2.2510.0, 10.1.2507.11, 10.0.2503.9, and 9.3.2411.120, a user of a Splunk Search Head Cluster (SHC) deployment who ho…
- 4.9CVE-2026-20142EPSS 0.3%
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the RSA `accessKey` value from th…
- 4.9CVE-2026-20138EPSS 0.3%
In Splunk Enterprise versions below 10.2.0, 10.0.2, 9.4.7, 9.3.9, and 9.2.11, a user of a Splunk Search Head Cluster (SHC) deployment who holds a role with access to the Splunk `_internal` index could view the `integrationKey`, `secretKey…
- 3.3CVE-2026-20663EPSS 0.1%
The issue was resolved by sanitizing logging. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3. An app may be able to enumerate a user's installed apps.
- 3.3CVE-2026-20646EPSS 0.1%
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location information.
- 5.7CVE-2026-1495EPSS 0.1%
The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized a…
- 5.5CVE-2026-21222EPSS 0.6%
Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.
- 7.8CVE-2025-11547EPSS 0.2%
AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.
- 5.9CVE-2026-25918EPSS 0.2%
unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments i…
- 8.7CVE-2026-25813EPSS 0.3%
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, The application logs highly sensitive data directly to console output without masking or redaction.
- 6.5CVE-2026-25846EPSS 1.0%
In JetBrains YouTrack before 2025.3.119033 access tokens could be exposed in Mailbox logs
- 4.9CVE-2025-15332EPSS 0.4%
Tanium addressed an information disclosure vulnerability in Threat Response.
- 8.1CVE-2026-22038EPSS 0.5%
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.46, the AutoGPT platform's Stagehand integration blocks lo…
- 4.8CVE-2026-1622EPSS 0.2%
Neo4j Enterprise and Community editions versions prior to 2026.01.3 and 5.26.21 are vulnerable to a potential information disclosure by a user who has ability to access the local log files. The "obfuscate_literals" option in the query lo…
- 6.9CVE-2026-24762EPSS 0.3%
RustFS is a distributed object storage system built in Rust. From versions alpha.13 to alpha.81, RustFS logs sensitive credential material (access key, secret key, session token) to application logs at INFO level. This results in credentia…
- 9.8CVE-2026-22778ExploitEPSS 18%
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap …
- 3.2CVE-2026-25211EPSS 0.2%
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
- 5.1CVE-2026-0936EPSS 0.1%
An Insertion of Sensitive Information into Log File vulnerability in B&R PVI client versions prior to 6.5 may be abused by an authenticated local attacker to gather credential information which is processed by the PVI client application. T…
- 4.9CVE-2025-13925EPSS 0.3%
IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.
- 6.5CVE-2025-59355EPSS 0.5%
A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in the log via logger.error(str + "decode failed", e). If the input parameter contai…
- 4.6CVE-2026-0519EPSS 0.1%
In Secure Access 12.70 and prior to 14.20, the logging subsystem may write an unredacted authentication token to logs under certain configurations. Any party with access to those logs could read the token and reuse it to access an integ…
- 5.5CVE-2025-43508EPSS 0.2%
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data.
- 2.9CVE-2026-22782EPSS 0.5%
RustFS is a distributed object storage system built in Rust. From >= 1.0.0-alpha.1 to 1.0.0-alpha.79, invalid RPC signatures cause the server to log the shared HMAC secret (and expected signature), which exposes the secret to log readers a…
- 7.5CVE-2025-68675EPSS 1.9%
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore…
- 4.9CVE-2026-23493EPSS 0.4%
Pimcore is an Open Source Data & Experience Management Platform. Prior to 12.3.1 and 11.5.14, the http_error_log file stores the $_COOKIE and $_SERVER variables, which means sensitive information such as database passwords, cookie session …
- 6.2CVE-2026-20818EPSS 0.7%
Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.
- 5.0CVE-2026-22798EPSS 0.2%
hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If u…
- 5.6CVE-2025-68919EPSS 0.1%
Fujitsu / Fsas Technologies ETERNUS SF ACM/SC/Express (DX / AF Management Software) before 16.8-16.9.1 PA 2025-12, when collected maintenance data is accessible by a principal/authority other than ETERNUS SF Admin, allows an attacker to po…
- 6.0CVE-2025-66910EPSS 0.2%
Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to op…
- 7.5CVE-2025-14437ExploitEPSS 1.8%
The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request' function. This makes it possible for unauthenticated attackers to extract sensi…
- 3.3CVE-2025-46277EPSS 0.2%
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able to access a user’s Safari history.
- 5.5CVE-2025-43475EPSS 0.2%
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data.