CWE-532 · Insertion of Sensitive Information into Log File (page 10)
Page 10 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-37760 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2021-37759 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2021-21546 | High | 7.8 | 2021-07-29 | Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. A local low-privileged user… |
CVE-2021-28131 | High | 7.5 | 2021-07-22 | Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, theref… |
CVE-2020-21933 | High | 7.5 | 2021-07-21 | An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar packag… |
CVE-2020-23284 | High | 7.5 | 2021-07-20 | Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that conne… |
CVE-2021-32767 | Medium | 5.3 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user cred… |
CVE-2021-34689 | Medium | 5.5 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the system's Personal Key in world-readable %… |
CVE-2021-29759 | Low | 2.3 | 2021-07-07 | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IB… |
CVE-2020-24038 | Medium | 6.5 | 2021-07-07 | myFax version 229 logs sensitive information in the export log module which allows any user to access critical information. |
CVE-2021-35299 | High | 7.5 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. |
CVE-2021-0549 | Medium | 4.4 | 2021-06-22 | In sspRequestCallback of BondStateMachine.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local… |
CVE-2021-25423 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25422 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25421 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25420 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2020-15380 | High | 7.5 | 2021-06-09 | Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. |
CVE-2021-22219 | Medium | 4.4 | 2021-06-08 | All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-21558 | High | 8.2 | 2021-06-08 | Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system… |
CVE-2021-22516 | High | 7.5 | 2021-06-04 | Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability co… |
CVE-2021-3425 | Medium | 4.4 | 2021-06-01 | A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdb… |
CVE-2021-20191 | Medium | 5.5 | 2021-05-26 | A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those m… |
CVE-2021-20178 | Medium | 5.5 | 2021-05-26 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbu… |
CVE-2017-17675 | Medium | 5.3 | 2021-05-19 | BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system… |
CVE-2021-3528 | High | 8.8 | 2021-05-13 | A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log… |
CVE-2021-32074 | High | 7.5 | 2021-05-07 | HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was n… |
CVE-2021-20536 | Medium | 6.2 | 2021-04-26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-… |
CVE-2021-26908 | Low | 3.3 | 2021-04-23 | Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert… |
CVE-2021-31546 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have… |
CVE-2021-3037 | Low | 2.3 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration… |
CVE-2021-3036 | Medium | 4.4 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in clea… |
CVE-2021-24024 | Medium | 4.3 | 2021-04-12 | A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may… |
CVE-2021-23924 | High | 7.5 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. |
CVE-2021-3447 | Medium | 5.5 | 2021-04-01 | A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as wel… |
CVE-2021-22184 | Medium | 6.2 | 2021-03-26 | An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't pro… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-1442 | High | 7.8 | 2021-03-24 | A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate… |
CVE-2021-22310 | Medium | 4.4 | 2021-03-22 | There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific information in the log file, the attacker can ob… |
CVE-2021-3167 | Medium | 6.5 | 2021-03-15 | In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. |
CVE-2021-3034 | Medium | 5.1 | 2021-03-10 | An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integrati… |
CVE-2021-21361 | Medium | 5.3 | 2021-03-09 | The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables… |
CVE-2021-25284 | Medium | 4.4 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
CVE-2021-25688 | Medium | 5.5 | 2021-02-11 | Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts… |
CVE-2021-22133 | Low | 2.4 | 2021-02-10 | The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally… |
CVE-2020-7021 | Medium | 4.9 | 2021-02-10 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasti… |
CVE-2021-20359 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files th… |
CVE-2021-21722 | Medium | 4.4 | 2021-01-14 | A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain… |
CVE-2021-1226 | Medium | 4.3 | 2021-01-13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco… |
CVE-2021-3032 | Medium | 4.4 | 2021-01-13 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “s… |
CVE-2020-26199 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the U… |
CVE-2020-0476 | Medium | 4.4 | 2020-12-15 | In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. This could lead to local information disclosure with Sys… |
CVE-2020-35234 | High | 7.5 | 2020-12-14 | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list th… |
CVE-2020-26416 | Medium | 4.0 | 2020-12-11 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=… |
CVE-2020-8566 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in… |
CVE-2020-8565 | Medium | 4.7 | 2020-12-07 | In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs… |
CVE-2020-8564 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file bei… |
CVE-2020-8563 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud control… |
CVE-2020-6317 | Low | 3.5 | 2020-11-30 | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears… |
CVE-2020-4900 | Medium | 5.5 | 2020-11-30 | IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991. |
CVE-2020-25640 | Medium | 5.3 | 2020-11-24 | A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensi… |
CVE-2020-10763 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heke… |
CVE-2020-10762 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording… |
CVE-2020-4671 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that cou… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-11646 | Medium | 4.3 | 2020-10-15 | A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticat… |
CVE-2020-11643 | Medium | 6.5 | 2020-10-15 | An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated… |
CVE-2020-5389 | Medium | 6.5 | 2020-10-08 | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerabilit… |
CVE-2020-26605 | High | 7.5 | 2020-10-06 | An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by… |
CVE-2020-25987 | High | 7.5 | 2020-10-06 | MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used… |
CVE-2020-9486 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, t… |
CVE-2020-15370 | Medium | 6.5 | 2020-09-25 | Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerabili… |
CVE-2020-14332 | Medium | 5.5 | 2020-09-11 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed… |
CVE-2020-14330 | Medium | 5.0 | 2020-09-11 | An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-24566 | High | 7.5 | 2020-09-09 | In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and… |
CVE-2020-7322 | Medium | 4.7 | 2020-09-09 | Information Disclosure Vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to gain access to s… |
CVE-2020-3541 | Medium | 4.4 | 2020-09-04 | A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams f… |
CVE-2020-25046 | Medium | 5.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The S… |
CVE-2020-14518 | Medium | 5.3 | 2020-08-21 | Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker. |
CVE-2020-3447 | Medium | 5.5 | 2020-08-17 | A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) co… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-6295 | High | 7.8 | 2020-08-12 | Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information throug… |
CVE-2020-15829 | Medium | 5.3 | 2020-08-08 | In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. |
CVE-2020-5414 | Medium | 5.7 | 2020-07-31 | VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Au… |
CVE-2020-4498 | Medium | 4.4 | 2020-07-27 | IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM… |
CVE-2020-4405 | Medium | 4.3 | 2020-07-27 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force… |
CVE-2020-6938 | High | 7.5 | 2020-07-08 | A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive… |
CVE-2020-15095 | Medium | 4.4 | 2020-07-07 | Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<u… |
CVE-2020-15581 | Medium | 5.3 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual ad… |
CVE-2020-5908 | Medium | 5.5 | 2020-07-01 | In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2020-10750 | High | 7.1 | 2020-06-19 | Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw… |
CVE-2020-14470 | Medium | 6.5 | 2020-06-19 | In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. |
CVE-2019-20852 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message cont… |
CVE-2020-4477 | Medium | 6.5 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attac… |
CVE-2020-10752 | High | 7.5 | 2020-06-12 | A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurr… |
CVE-2020-3930 | Medium | 4.0 | 2020-06-12 | GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs. |
CVE-2020-12023 | Low | 2.0 | 2020-06-11 | Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue (VS30) and IntelliV… |