OWASP A09:2025 Logging & Alerting Failures vulnerabilities, newest first, page 12
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A09:2025 at MITRE.
- 6.5CVE-2025-1296EPSS 0.5%
Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edit…
- 5.3CVE-2025-25294EPSS 0.3%
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior to 1.2.7 and 1.3.1 a default Envoy Proxy access log configuration is used. This f…
- 5.2CVE-2025-1696EPSS 0.2%
A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs. In affected versions, proxy configuration data—potentially including sensitive …
- 5.7CVE-2025-1979EPSS 0.2%
Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logge…
- 6.9CVE-2025-27111EPSS 0.8%
Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can exploit this by injecting escape sequences (such as newline characters) into the hea…
- 6.9CVE-2025-23405EPSS 0.3%
Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks (ex log injection).
- 3.3CVE-2024-45674EPSS 0.2%
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores potentially sensitive information …
- 7.5CVE-2024-13818EPSS 0.5%
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and incl…
- 6.5CVE-2024-49355EPSS 0.3%
IBM OpenPages with Watson 8.3 and 9.0 may write improperly neutralized data to server log files when the tracing is enabled per the System Tracing feature.
- 5.6CVE-2025-1075EPSS 0.3%
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.
- 8.6CVE-2025-1053EPSS 0.2%
Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave. An attacker with privileged access to the Brocade SANnav database could use t…
- 5.7CVE-2025-25184EPSS 1.2%
Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.11, 3.0.12, and 3.1.10, Rack::CommonLogger can be exploited by crafting input that includes newline characters to manipulate log entries. The supplie…
- 5.1CVE-2022-35202EPSS 0.3%
A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the private keys used for signing SAML Authn requests. The underlying issue is a Java keystore that may…
- 4.3CVE-2024-13416EPSS 0.4%
Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated version 2.46 of 2N OS, where this vulnerability is mitigated. It is recommended th…
- 7.5CVE-2024-57957EPSS 0.3%
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 5.3CVE-2024-56473EPSS 0.3%
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers.
- 6.7CVE-2025-23413EPSS 0.2%
When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are no…
- 7.5CVE-2025-24556EPSS 0.5%
Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWoodle: from n/a through <= 3.2.4.
- 4.9CVE-2025-23374EPSS 0.3%
Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A high privileged attacker with remote access could potentially exploi…
- 5.1CVE-2025-24884EPSS 0.2%
kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in t…
- 6.9CVE-2024-48852ExploitEPSS 2.5%
Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.
- 4.3CVE-2025-0754EPSS 0.3%
The vulnerability was found in OpenShift Service Mesh 2.6.3 and 2.5.6. This issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the x-forwarded-for header. This lack of sanitization can allow attackers to injec…
- 5.5CVE-2025-0736EPSS 0.2%
A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure c…
- 7.5CVE-2025-24169EPSS 0.8%
A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.
- 3.3CVE-2025-24145EPSS 0.2%
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An app may be able to view a contact's phone number in system logs.
- 5.5CVE-2024-54519EPSS 0.2%
The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read sensitive location information.
- 6.3CVE-2025-24389EPSS 0.1%
Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system administrator. This issue affects: * OTRS 7.0.X * OTRS 8.0.X * OTR…
- 5.3CVE-2024-35150EPSS 0.3%
IBM Maximo Application Suite 8.10.12, 8.11.0, 9.0.1, and 9.1.0 - Monitor Component does not neutralize output that is written to logs, which could allow an attacker to inject false log entries.
- 6.5CVE-2023-38271EPSS 0.3%
IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authenticated user to obtain sensitive information from log files.
- 7.1CVE-2025-24362EPSS 1.2%
In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to…
- 3.2CVE-2025-24034EPSS 0.2%
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled…
- 5.5CVE-2025-24457EPSS 0.6%
In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs
- 5.5CVE-2024-45091EPSS 0.2%
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.
- 5.5CVE-2024-11923EPSS 0.2%
Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to version 1.3
- 6.5CVE-2024-12226EPSS 0.4%
In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was identified in Version 2 however it was determined that this could also be achieve…
- 5.3CVE-2024-55891EPSS 0.3%
TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised …
- 5.5CVE-2025-21323EPSS 0.9%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21321EPSS 1.0%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21320EPSS 1.0%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21319EPSS 1.0%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21318EPSS 1.0%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21317EPSS 0.9%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2025-21316EPSS 1.0%
Windows Kernel Memory Information Disclosure Vulnerability
- 5.5CVE-2024-40679EPSS 0.2%
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions.
- 4.3CVE-2024-52813EPSS 0.5%
matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. Versions of the matrix-sdk-crypto Rust crate before 0.8.0 lack a dedicated mechanism to notify that a user's cryptographic identity has changed from a verified…
- 5.4CVE-2024-52891EPSS 0.3%
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.
- 6.3CVE-2024-7696EPSS 0.2%
Seth Fogie, member of AXIS Camera Station Pro Bug Bounty Program, has found that it is possible for an authenticated malicious client to tamper with audit log creation in AXIS Camera Station, or perform a Denial-of-Service attack on the AX…
- 9.3CVE-2025-22275EPSS 0.5%
iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, d…
- 5.2CVE-2024-12569EPSS 0.1%
Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
- 4.4CVE-2024-49816EPSS 0.4%
IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.