CWE-532 · Insertion of Sensitive Information into Log File (page 11)
Page 11 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13223 | High | 7.5 | 2020-06-10 | HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2. |
CVE-2020-13881 | High | 7.5 | 2020-06-06 | In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used. |
CVE-2020-13830 | High | 7.5 | 2020-06-04 | An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020). |
CVE-2020-11094 | Medium | 6.1 | 2020-06-04 | The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request includin… |
CVE-2020-3281 | High | 8.8 | 2020-06-03 | A vulnerability in the audit logging component of Cisco Digital Network Architecture (DNA) Center could allow an authenticated, remote attacker to view sensiti… |
CVE-2020-7654 | High | 7.5 | 2020-05-29 | All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG. |
CVE-2020-2004 | Medium | 6.8 | 2020-05-13 | Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on Globa… |
CVE-2020-11932 | Low | 2.3 | 2020-05-13 | It was discovered that the Subiquity installer for Ubuntu Server logged the LUKS full disk encryption password if one was entered. |
CVE-2020-1698 | Medium | 5.0 | 2020-05-11 | A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat… |
CVE-2019-4286 | Medium | 4.3 | 2020-04-29 | IBM Maximo Anywhere 7.6.2.0, 7.6.2.1, 7.6.3.0, and 7.6.3.1 could disclose highly senstiive user information to an authenticated user with physical access to th… |
CVE-2020-10712 | High | 7.0 | 2020-04-22 | A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an… |
CVE-2020-11968 | High | 7.5 | 2020-04-21 | In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulner… |
CVE-2020-6224 | Medium | 6.2 | 2020-04-14 | SAP NetWeaver AS Java (HTTP Service), versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker with administrator privileges to access user sensit… |
CVE-2020-1624 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affect… |
CVE-2020-1623 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can view sensitive configuration information via the ev.ops configuration file. This issue affects all versions of Junos… |
CVE-2020-1622 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSharedObjStore. This issue affects all ver… |
CVE-2020-1621 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords via configd traces. This issue affects all versions of Junos OS Evolved… |
CVE-2020-1620 | Medium | 5.5 | 2020-04-08 | A local, authenticated user with shell can obtain the hashed values of login passwords via configd streamer log. This issue affects all versions of Junos OS Ev… |
CVE-2020-1987 | Low | 3.9 | 2020-04-08 | An information exposure vulnerability in the logging component of Palo Alto Networks Global Protect Agent allows a local authenticated user to read VPN cookie… |
CVE-2020-11605 | High | 7.5 | 2020-04-08 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is sensitive information exposure from dumpstate in NFC logs… |
CVE-2020-7599 | Medium | 6.5 | 2020-03-30 | All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gr… |
CVE-2019-20625 | Low | 3.3 | 2020-03-24 | An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The… |
CVE-2019-16528 | High | 7.5 | 2020-03-20 | An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such… |
CVE-2020-5262 | High | 7.7 | 2020-03-19 | In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`… |
CVE-2020-1753 | Medium | 5.0 | 2020-03-16 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versi… |
CVE-2019-18576 | Medium | 6.7 | 2020-03-13 | Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious loc… |
CVE-2019-19756 | High | 7.9 | 2020-03-13 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems… |
CVE-2019-16157 | Medium | 6.5 | 2020-03-13 | An information exposure vulnerability in Fortinet FortiWeb 6.2.0 CLI and earlier may allow an authenticated user to view sensitive information being logged via… |
CVE-2020-4083 | Medium | 5.5 | 2020-03-05 | HCL Connections 6.5 is vulnerable to possible information leakage. Connections could disclose sensitive information via trace logs to a local user. |
CVE-2020-5400 | Medium | 6.5 | 2020-02-27 | Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information… |
CVE-2020-0018 | Medium | 4.4 | 2020-02-13 | In MotionEntry::appendDescription of InputDispatcher.cpp, there is a possible log information disclosure. This could lead to local disclosure of user input wit… |
CVE-2020-1942 | High | 7.5 | 2020-02-11 | In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a no… |
CVE-2019-16204 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the… |
CVE-2019-16203 | High | 7.5 | 2020-02-05 | Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line… |
CVE-2019-18193 | High | 7.5 | 2020-02-03 | In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4… |
CVE-2020-1928 | Medium | 5.3 | 2020-01-28 | An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This wo… |
CVE-2018-20105 | Medium | 4.0 | 2020-01-27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn… |
CVE-2020-5225 | Medium | 4.4 | 2020-01-24 | Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system admini… |
CVE-2019-14885 | Medium | 4.3 | 2020-01-23 | A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is r… |
CVE-2020-7215 | Medium | 5.5 | 2020-01-20 | An issue was discovered in Gallagher Command Centre 7.x before 7.90.991(MR5), 8.00 before 8.00.1161(MR5), and 8.10 before 8.10.1134(MR4). External system confi… |
CVE-2019-18244 | Medium | 4.7 | 2020-01-15 | In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files when service accounts are customized during… |
CVE-2019-11292 | Medium | 6.5 | 2020-01-09 | Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomca… |
CVE-2019-14854 | Medium | 6.5 | 2020-01-07 | OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low… |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-3429 | Medium | 5.3 | 2019-12-23 | All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without aut… |
CVE-2019-19150 | Medium | 4.9 | 2019-12-23 | On versions 15.0.0-15.0.1.1, 14.1.0-14.1.2, 14.0.0-14.0.1, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.5.2-11.6.5.1, the BIG-IP APM system logs the client-session-i… |
CVE-2019-15235 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.864 allows an attacker to get a victim's session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx… |
CVE-2019-14782 | Medium | 6.5 | 2019-12-17 | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.856 through 0.9.8.864 allows an attacker to get a victim's session file name from the /tmp directory, and… |
CVE-2014-3536 | Medium | 5.5 | 2019-12-15 | CFME (CloudForms Management Engine) 5: RHN account information is logged to top_output.log during registration |
CVE-2019-10695 | Medium | 6.5 | 2019-12-12 | When using the cd4pe::root_configuration task to configure a Continuous Delivery for PE installation, the root user’s username and password were exposed in the… |
CVE-2019-11293 | Medium | 6.5 | 2019-12-06 | Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote… |
CVE-2019-10195 | Medium | 6.5 | 2019-11-27 | A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch… |
CVE-2019-11290 | High | 7.5 | 2019-11-26 | Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentica… |
CVE-2019-10213 | Medium | 6.5 | 2019-11-25 | OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or… |
CVE-2019-19039 | Medium | 5.5 | 2019-11-21 | __btrfs_free_extent in fs/btrfs/extent-tree.c in the Linux kernel through 5.3.12 calls btrfs_print_leaf in a certain ENOENT case, which allows local users to o… |
CVE-2019-6662 | Medium | 6.5 | 2019-11-15 | On BIG-IP 13.1.0-13.1.1.4, sensitive information is logged into the local log files and/or remote logging targets when restjavad processes an invalid request… |
CVE-2012-1156 | High | 7.5 | 2019-11-14 | Moodle before 2.2.2 has users' private files included in course backups |
CVE-2019-3649 | Medium | 5.3 | 2019-11-13 | Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed creden… |
CVE-2019-16210 | Medium | 5.5 | 2019-11-08 | Brocade SANnav versions before v2.0, logs plain text database connection password while triggering support save. |
CVE-2019-16206 | Medium | 5.5 | 2019-11-08 | The authentication mechanism, in Brocade SANnav versions before v2.0, logs plaintext account credentials at the ‘trace’ and the 'debug' logging level; which co… |
CVE-2013-1771 | High | 7.5 | 2019-11-07 | The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo. |
CVE-2019-10084 | High | 7.5 | 2019-11-05 | In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries… |
CVE-2019-18385 | High | 7.5 | 2019-10-23 | An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring. |
CVE-2019-11283 | High | 8.8 | 2019-10-23 | Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs ca… |
CVE-2019-17395 | Critical | 9.8 | 2019-10-15 | In the Rapid Gator application 0.7.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via… |
CVE-2019-17398 | Critical | 9.8 | 2019-10-15 | In the Dark Horse Comics application 1.3.21 for Android, token information (equivalent to the username and password) is stored in the log during authentication… |
CVE-2019-17396 | Critical | 9.8 | 2019-10-15 | In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attacke… |
CVE-2019-17394 | Critical | 9.8 | 2019-10-15 | In the Seesaw Parent and Family application 6.2.5 for Android, the username and password are stored in the log during authentication, and may be available to a… |
CVE-2019-17355 | Critical | 9.8 | 2019-10-15 | In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via log… |
CVE-2019-17397 | Critical | 9.8 | 2019-10-15 | In the DoorDash application through 11.5.2 for Android, the username and password are stored in the log during authentication, and may be available to attacker… |
CVE-2019-14858 | Medium | 5.5 | 2019-10-14 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_… |
CVE-2019-4572 | Medium | 4.4 | 2019-10-14 | IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an… |
CVE-2019-0380 | Medium | 4.9 | 2019-10-08 | Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure parameters’ default values to be part of the ap… |
CVE-2019-14846 | High | 7.8 | 2019-10-08 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to… |
CVE-2019-10212 | Critical | 9.8 | 2019-10-02 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the… |
CVE-2019-16116 | Medium | 4.3 | 2019-10-02 | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the… |
CVE-2019-9277 | Low | 3.3 | 2019-09-27 | In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser ac… |
CVE-2019-6656 | High | 7.5 | 2019-09-25 | BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled wi… |
CVE-2019-5532 | High | 7.7 | 2019-09-18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging… |
CVE-2019-3763 | High | 8.8 | 2019-09-11 | The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerabili… |
CVE-2019-11465 | Medium | 5.3 | 2019-09-10 | An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The sy… |
CVE-2019-11549 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly… |
CVE-2019-6648 | Medium | 4.4 | 2019-09-04 | On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BI… |
CVE-2019-11250 | Medium | 6.5 | 2019-08-29 | The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or comma… |
CVE-2019-15294 | Critical | 9.8 | 2019-08-28 | An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor manageme… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-5634 | Medium | 6.5 | 2019-08-22 | An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communicati… |
CVE-2019-13515 | Medium | 6.5 | 2019-08-15 | OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information. |
CVE-2018-20956 | Medium | 5.5 | 2019-08-08 | Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31. |
CVE-2019-1961 | Medium | 4.9 | 2019-08-08 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying… |
CVE-2019-1953 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in c… |
CVE-2019-10370 | Medium | 6.5 | 2019-08-07 | Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting… |
CVE-2019-10367 | Medium | 5.5 | 2019-08-07 | Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be… |
CVE-2019-4284 | Medium | 4.4 | 2019-08-05 | IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could… |
CVE-2017-18426 | Low | 2.7 | 2019-08-02 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). |
CVE-2017-18423 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). |
CVE-2017-18412 | Low | 2.5 | 2019-08-02 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). |
CVE-2016-10819 | Medium | 6.5 | 2019-08-01 | In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). |
CVE-2019-10364 | Medium | 5.5 | 2019-07-31 | Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. |