OWASP A09:2025 Logging & Alerting Failures vulnerabilities, newest first, page 27
Filter
The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A09:2025 at MITRE.
- 7.5CVE-2019-11290EPSS 1.3%
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
- 6.5CVE-2019-10213EPSS 1.0%
OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material i…
- 5.5CVE-2019-19039EPSS 0.7%
__btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to obtain potentially sensitive information about register values via the dmesg prog…
- 6.5CVE-2019-6662EPSS 0.9%
On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request. Users with access to the log files would be able to view that data.
- 7.5CVE-2012-1156EPSS 2.1%
Moodle before 2.2.2 has users' private files included in course backups
- 6.5CVE-2019-3649EPSS 0.9%
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed credentials via carefully constructed POST request extracting incorrectly recorded dat…
- 5.5CVE-2019-16210EPSS 0.2%
Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save.
- 5.5CVE-2019-16206EPSS 0.2%
The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which could allow a local authenticated attacker to access sensitive information.
- 7.5CVE-2013-1771EPSS 3.0%
The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.
- 7.5CVE-2019-10084EPSS 1.0%
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization…
- 7.5CVE-2019-18385EPSS 1.9%
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.
- 8.8CVE-2019-11283EPSS 1.5%
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created…
- 9.8CVE-2019-17395EPSS 1.3%
In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
- 9.8CVE-2019-17398EPSS 1.3%
In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log during authentication, and may be available to attackers via logcat.
- 9.8CVE-2019-17396EPSS 1.2%
In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
- 9.8CVE-2019-17394EPSS 1.3%
In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
- 9.8CVE-2019-17355EPSS 1.3%
In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
- 9.8CVE-2019-17397EPSS 1.3%
In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
- 5.5CVE-2019-14858EPSS 0.4%
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail…
- 4.4CVE-2019-4572EPSS 0.3%
IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an administrator on the local machine. IBM X-Force ID: 166798.
- 4.9CVE-2019-0380EPSS 0.9%
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the application logs leading to Information Disclosure.
- 7.8CVE-2019-14846EPSS 0.5%
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials …
- 9.8CVE-2019-10212EPSS 1.9%
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
- 4.3CVE-2019-16116ExploitEPSS 3.7%
EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.
- 3.3CVE-2019-9277EPSS 0.2%
In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser activity with User execution privileges needed. User interaction is not needed for…
- 7.5CVE-2019-6656EPSS 1.4%
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-1…
- 7.7CVE-2019-5532EPSS 1.9%
VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging of credentials in plain-text for virtual machines deployed through OVF. A malic…
- 7.8CVE-2019-3763EPSS 0.3%
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerability. The Office 365 user password may get logged in a plain text format in the Of…
- 5.3CVE-2019-11465EPSS 1.2%
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the use…
- 6.5CVE-2019-11549EPSS 1.3%
An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly has allows an information disclosure issue where HTTP/GIT credentials are inclu…
- 4.4CVE-2019-6648EPSS 0.3%
On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as…
- 6.5CVE-2019-11250EPSS 1.8%
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, whic…
- 9.8CVE-2019-15294EPSS 1.2%
An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are …
- 6.5CVE-2019-15508EPSS 0.7%
In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstances) could trigger a deployment that writes the web request proxy password to th…
- 6.5CVE-2019-15507EPSS 0.6%
In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to t…
- 4.3CVE-2019-5634EPSS 0.4%
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetoot…
- 6.5CVE-2019-13515EPSS 1.3%
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
- 5.5CVE-2018-20956EPSS 0.4%
Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31.
- 4.9CVE-2019-1961EPSS 1.9%
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the im…
- 6.5CVE-2019-1953EPSS 1.5%
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password wh…
- 6.5CVE-2019-10370EPSS 1.3%
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.
- 5.5CVE-2019-10367EPSS 0.4%
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
- 4.4CVE-2019-4284EPSS 0.4%
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512.
- 2.7CVE-2017-18426EPSS 0.7%
cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288).
- 3.3CVE-2017-18423EPSS 0.4%
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
- 2.5CVE-2017-18412EPSS 0.3%
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
- 6.5CVE-2016-10819EPSS 1.1%
In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).
- 5.5CVE-2019-10364EPSS 0.3%
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.
- 6.5CVE-2019-10358EPSS 1.0%
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
- 5.5CVE-2019-10345EPSS 0.3%
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.