CWE-532 · Insertion of Sensitive Information into Log File (page 10)
Page 10 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-2043 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-O… |
CVE-2020-24566 | High | 7.5 | 2020-09-09 | In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and… |
CVE-2020-7322 | Medium | 4.7 | 2020-09-09 | Information Disclosure Vulnerability in McAfee Endpoint Security (ENS) for Windows prior to 10.7.0 September 2020 Update allows local users to gain access to s… |
CVE-2020-3541 | Medium | 4.4 | 2020-09-04 | A vulnerability in the media engine component of Cisco Webex Meetings Client for Windows, Cisco Webex Meetings Desktop App for Windows, and Cisco Webex Teams f… |
CVE-2020-25046 | Medium | 5.5 | 2020-08-31 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The S… |
CVE-2020-14518 | Medium | 5.3 | 2020-08-21 | Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker. |
CVE-2020-3447 | Medium | 5.5 | 2020-08-17 | A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) co… |
CVE-2020-6653 | Low | 3.8 | 2020-08-12 | Eaton's Secure connect mobile app v1.7.3 & prior stores the user login credentials in logcat file when user create or register the account on the Mobile app. A… |
CVE-2020-6295 | High | 7.8 | 2020-08-12 | Under certain conditions the SAP Adaptive Server Enterprise, version 16.0, allows an attacker to access encrypted sensitive and confidential information throug… |
CVE-2020-15829 | Medium | 5.3 | 2020-08-08 | In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs. |
CVE-2020-5414 | Medium | 5.7 | 2020-07-31 | VMware Tanzu Application Service for VMs (2.7.x versions prior to 2.7.19, 2.8.x versions prior to 2.8.13, and 2.9.x versions prior to 2.9.7) contains an App Au… |
CVE-2020-4498 | Medium | 4.4 | 2020-07-27 | IBM MQ Appliance 9.1 LTS and 9.1 CD could allow a local privileged user to obtain highly sensitve information due to inclusion of data within trace files. IBM… |
CVE-2020-4405 | Medium | 4.3 | 2020-07-27 | IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force… |
CVE-2020-6938 | High | 7.5 | 2020-07-08 | A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive… |
CVE-2020-15095 | Medium | 4.4 | 2020-07-07 | Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<u… |
CVE-2020-15581 | Medium | 5.3 | 2020-07-07 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual ad… |
CVE-2020-5908 | Medium | 5.5 | 2020-07-01 | In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files. |
CVE-2019-4706 | Low | 2.7 | 2020-07-01 | IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attac… |
CVE-2020-10750 | High | 7.1 | 2020-06-19 | Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw… |
CVE-2020-14470 | Medium | 6.5 | 2020-06-19 | In Octopus Deploy 2018.8.0 through 2019.x before 2019.12.2, an authenticated user with could trigger a deployment that leaks the Helm Chart repository password. |
CVE-2019-20852 | High | 7.5 | 2020-06-19 | An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message cont… |
CVE-2020-4477 | Medium | 6.5 | 2020-06-15 | IBM Spectrum Protect Plus 10.1.0 through 10.1.5 discloses highly sensitive information in plain text in the virgo log file which could be used in further attac… |
CVE-2020-10752 | High | 7.5 | 2020-06-12 | A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurr… |
CVE-2020-3930 | Medium | 4.0 | 2020-06-12 | GeoVision Door Access Control device family improperly stores and controls access to system logs, any users can read these logs. |
CVE-2020-12023 | Low | 2.0 | 2020-06-11 | Philips IntelliBridge Enterprise (IBE), Versions B.12 and prior, IntelliBridge Enterprise system integration with SureSigns (VS4), EarlyVue (VS30) and IntelliV… |
CVE-2020-13223 | High | 7.5 | 2020-06-10 | HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2. |
CVE-2020-13881 | High | 7.5 | 2020-06-06 | In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. |
CVE-2020-13830 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020). |
CVE-2020-11094 | Medium | 6.1 | 2020-06-04 | The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request includin… |
CVE-2020-3281 | High | 8.8 | 2020-06-03 | A vulnerability in the audit logging component of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensiti… |
CVE-2020-7654 | High | 7.5 | 2020-05-29 | All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. |
CVE-2020-2004 | Medium | 6.8 | 2020-05-13 | Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on Globa… |
CVE-2020-11932 | Low | 2.3 | 2020-05-13 | It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered. |
CVE-2020-1698 | Medium | 5.0 | 2020-05-11 | A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat… |
CVE-2019-4286 | Medium | 4.3 | 2020-04-29 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to th… |
CVE-2020-10712 | High | 7.0 | 2020-04-22 | A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an… |
CVE-2020-11968 | High | 7.5 | 2020-04-21 | In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulner… |
CVE-2020-6224 | Medium | 6.2 | 2020-04-14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensit… |
CVE-2020-1624 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affect… |
CVE-2020-1623 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can view sensitive configuration information via the ev.ops configuration file. This issue affects all versions of Junos… |
CVE-2020-1622 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSharedObjStore. This issue affects all ver… |
CVE-2020-1621 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions of Junos OS Evolved… |
CVE-2020-1620 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Ev… |
CVE-2020-1987 | Low | 3.9 | 2020-04-08 | An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie… |
CVE-2020-11605 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is sensitive information exposure from dumpstate in NFC logs… |
CVE-2020-7599 | Medium | 6.5 | 2020-03-30 | All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gr… |
CVE-2019-20625 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The… |
CVE-2019-16528 | High | 7.5 | 2020-03-20 | An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such… |
CVE-2020-5262 | High | 7.7 | 2020-03-19 | In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`… |
CVE-2020-1753 | Medium | 5.0 | 2020-03-16 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versi… |
CVE-2019-18576 | Medium | 6.7 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious loc… |
CVE-2019-19756 | High | 7.9 | 2020-03-13 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems… |
CVE-2019-16157 | Medium | 6.5 | 2020-03-13 | An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via… |
CVE-2020-4083 | Medium | 5.5 | 2020-03-05 | HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user. |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2020-0018 | Medium | 4.4 | 2020-02-13 | In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input wit… |
CVE-2020-1942 | High | 7.5 | 2020-02-11 | In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a no… |
CVE-2019-16204 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the… |
CVE-2019-16203 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line… |
CVE-2019-18193 | High | 7.5 | 2020-02-03 | In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4… |
CVE-2020-1928 | Medium | 5.3 | 2020-01-28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This wo… |
CVE-2018-20105 | Medium | 4.0 | 2020-01-27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn… |
CVE-2020-5225 | Medium | 4.4 | 2020-01-24 | Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system admini… |
CVE-2019-14885 | Medium | 4.3 | 2020-01-23 | A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is r… |
CVE-2020-7215 | Medium | 5.5 | 2020-01-20 | An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). External system confi… |
CVE-2019-18244 | Medium | 4.7 | 2020-01-15 | In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during… |
CVE-2019-11292 | Medium | 6.5 | 2020-01-09 | Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomca… |
CVE-2019-14854 | Medium | 6.5 | 2020-01-07 | OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low… |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-3429 | Medium | 5.3 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without aut… |
CVE-2019-19150 | Medium | 4.9 | 2019-12-23 | On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs the client-session-i… |
CVE-2019-15235 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx… |
CVE-2019-14782 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and… |
CVE-2014-3536 | Medium | 5.5 | 2019-12-15 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
CVE-2019-10695 | Medium | 6.5 | 2019-12-12 | When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the… |
CVE-2019-11293 | Medium | 6.5 | 2019-12-06 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2019-11290 | High | 7.5 | 2019-11-26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentica… |
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2019-19039 | Medium | 5.5 | 2019-11-21 | __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to o… |
CVE-2019-6662 | Medium | 6.5 | 2019-11-15 | On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request… |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2019-3649 | Medium | 5.3 | 2019-11-13 | Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed creden… |
CVE-2019-16210 | Medium | 5.5 | 2019-11-08 | Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. |
CVE-2019-16206 | Medium | 5.5 | 2019-11-08 | The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which co… |
CVE-2013-1771 | High | 7.5 | 2019-11-07 | The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo. |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2019-18385 | High | 7.5 | 2019-10-23 | An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring. |
CVE-2019-11283 | High | 8.8 | 2019-10-23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs ca… |
CVE-2019-17395 | Critical | 9.8 | 2019-10-15 | In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via… |
CVE-2019-17398 | Critical | 9.8 | 2019-10-15 | In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log during authentication… |
CVE-2019-17396 | Critical | 9.8 | 2019-10-15 | In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attacke… |
CVE-2019-17394 | Critical | 9.8 | 2019-10-15 | In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to a… |
CVE-2019-17355 | Critical | 9.8 | 2019-10-15 | In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via log… |
CVE-2019-17397 | Critical | 9.8 | 2019-10-15 | In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attacker… |
CVE-2019-14858 | Medium | 5.5 | 2019-10-14 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_… |
CVE-2019-4572 | Medium | 4.4 | 2019-10-14 | IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an… |
CVE-2019-0380 | Medium | 4.9 | 2019-10-08 | Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the ap… |
CVE-2019-14846 | High | 7.8 | 2019-10-08 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to… |
CVE-2019-10212 | Critical | 9.8 | 2019-10-02 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the… |