CWE-532 · Insertion of Sensitive Information into Log File (page 11)
Page 11 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-16116 | Medium | 4.3 | 2019-10-02 | EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the… |
CVE-2019-9277 | Low | 3.3 | 2019-09-27 | In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser ac… |
CVE-2019-6656 | High | 7.5 | 2019-09-25 | BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled wi… |
CVE-2019-5532 | High | 7.7 | 2019-09-18 | VMware vCenter Server (6.7.x prior to 6.7 U3, 6.5 prior to 6.5 U3 and 6.0 prior to 6.0 U3j) contains an information disclosure vulnerability due to the logging… |
CVE-2019-3763 | High | 8.8 | 2019-09-11 | The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 contain an information exposure vulnerabili… |
CVE-2019-11465 | Medium | 5.3 | 2019-09-10 | An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The sy… |
CVE-2019-11549 | Medium | 6.5 | 2019-09-09 | An issue was discovered in GitLab Community and Enterprise Edition 9.x, 10.x, and 11.x before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. Gitaly… |
CVE-2019-6648 | Medium | 4.4 | 2019-09-04 | On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BI… |
CVE-2019-11250 | Medium | 6.5 | 2019-08-29 | The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or comma… |
CVE-2019-15294 | Critical | 9.8 | 2019-08-28 | An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor manageme… |
CVE-2019-15508 | Medium | 6.5 | 2019-08-23 | In Octopus Tentacle versions 3.0.8 to 5.0.0, when a web request proxy is configured, an authenticated user (in certain limited OctopusPrintVariables circumstan… |
CVE-2019-15507 | Medium | 6.5 | 2019-08-23 | In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumsta… |
CVE-2019-5634 | Medium | 6.5 | 2019-08-22 | An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communicati… |
CVE-2019-13515 | Medium | 6.5 | 2019-08-15 | OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information. |
CVE-2018-20956 | Medium | 5.5 | 2019-08-08 | Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset. NOTE: all affected customers were migrated by 2020-08-31. |
CVE-2019-1961 | Medium | 4.9 | 2019-08-08 | A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying… |
CVE-2019-1953 | Medium | 6.5 | 2019-08-08 | A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in c… |
CVE-2019-10370 | Medium | 6.5 | 2019-08-07 | Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting… |
CVE-2019-10367 | Medium | 5.5 | 2019-08-07 | Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be… |
CVE-2019-4284 | Medium | 4.4 | 2019-08-05 | IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could… |
CVE-2017-18426 | Low | 2.7 | 2019-08-02 | cPanel before 66.0.2 allows resellers to read other accounts' domain log files (SEC-288). |
CVE-2017-18423 | Low | 3.3 | 2019-08-02 | In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273). |
CVE-2017-18412 | Low | 2.5 | 2019-08-02 | cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296). |
CVE-2016-10819 | Medium | 6.5 | 2019-08-01 | In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125). |
CVE-2019-10364 | Medium | 5.5 | 2019-07-31 | Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log. |
CVE-2019-10358 | Medium | 6.5 | 2019-07-31 | Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the bu… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-10165 | Low | 2.3 | 2019-07-30 | OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A… |
CVE-2019-0202 | High | 7.5 | 2019-07-26 | The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating… |
CVE-2019-14268 | Medium | 6.5 | 2019-07-25 | In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a… |
CVE-2019-11273 | Medium | 4.3 | 2019-07-23 | Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and… |
CVE-2019-13098 | Medium | 6.5 | 2019-07-22 | The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated… |
CVE-2019-13509 | High | 7.5 | 2019-07-18 | In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add sec… |
CVE-2019-10194 | Medium | 5.5 | 2019-07-11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclose… |
CVE-2018-19583 | Medium | 6.5 | 2019-07-10 | GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting adm… |
CVE-2019-4299 | Medium | 5.5 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is ena… |
CVE-2019-4296 | Low | 3.3 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log… |
CVE-2019-1622 | Medium | 5.3 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve s… |
CVE-2019-4225 | Medium | 4.4 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 15… |
CVE-2019-11271 | High | 7.8 | 2019-06-19 | Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database… |
CVE-2019-3888 | Critical | 9.8 | 2019-06-12 | A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeR… |
CVE-2019-9929 | High | 8.8 | 2019-06-06 | Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. |
CVE-2019-11336 | High | 8.1 | 2019-05-14 | Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sh… |
CVE-2019-6158 | High | 8.7 | 2019-05-03 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This on… |
CVE-2019-11492 | High | 7.5 | 2019-04-26 | ProjectSend before r1070 writes user passwords to the server logs. |
CVE-2019-9734 | High | 7.5 | 2019-04-24 | Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain c… |
CVE-2019-9724 | High | 7.5 | 2019-04-24 | aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component. |
CVE-2019-6157 | Medium | 6.5 | 2019-04-22 | In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's priva… |
CVE-2015-1343 | Low | 2.0 | 2019-04-22 | All versions of unity-scope-gdrive logs search terms to syslog. |
CVE-2019-3891 | High | 7.8 | 2019-04-15 | It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A… |
CVE-2019-9976 | High | 8.8 | 2019-04-11 | The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the… |
CVE-2019-0032 | High | 7.8 | 2019-04-10 | A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated a… |
CVE-2019-4143 | Medium | 5.5 | 2019-04-08 | The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS plugin container log… |
CVE-2019-3830 | High | 7.8 | 2019-03-26 | A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log file… |
CVE-2018-16856 | Medium | 5.5 | 2019-03-26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.201810… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2018-19513 | High | 7.5 | 2019-03-21 | In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file… |
CVE-2018-18466 | High | 7.0 | 2019-03-21 | An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credential… |
CVE-2018-17499 | Low | 2.9 | 2019-03-21 | Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted dat… |
CVE-2019-3716 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA… |
CVE-2019-3715 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log… |
CVE-2019-0741 | High | 7.5 | 2019-03-05 | An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnera… |
CVE-2019-8944 | Medium | 6.5 | 2019-02-20 | An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users t… |
CVE-2019-0266 | High | 7.5 | 2019-02-15 | Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file… |
CVE-2019-4008 | Critical | 9.8 | 2019-02-07 | API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files… |
CVE-2017-1198 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauth… |
CVE-2018-19014 | Medium | 6.5 | 2019-01-28 | Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Log files are access… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2019-0029 | High | 8.8 | 2019-01-15 | Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk ser… |
CVE-2019-0021 | High | 7.1 | 2019-01-15 | On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to v… |
CVE-2019-0004 | Medium | 5.5 | 2019-01-15 | On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operatio… |
CVE-2019-3500 | High | 7.8 | 2019-01-02 | aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sen… |
CVE-2018-15004 | Medium | 5.9 | 2018-12-28 | The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package nam… |
CVE-2018-15002 | Medium | 4.7 | 2018-12-28 | The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any app co-located on the device to set syst… |
CVE-2018-15001 | Medium | 5.5 | 2018-12-28 | The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name… |
CVE-2018-14995 | Medium | 4.7 | 2018-12-28 | The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blade Spark Android dev… |
CVE-2018-19863 | Medium | 5.5 | 2018-12-22 | An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. A mistake in error logging resulted in instances where sensitive data passed from… |
CVE-2018-15797 | High | 8.4 | 2018-12-05 | Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nf… |
CVE-2018-19865 | High | 7.5 | 2018-12-05 | A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. |
CVE-2018-19786 | High | 8.1 | 2018-12-05 | HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autos… |
CVE-2018-14700 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL l… |
CVE-2018-16859 | Medium | 4.2 | 2018-11-29 | Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear i… |
CVE-2018-16095 | Medium | 5.9 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. |
CVE-2018-1876 | Medium | 6.2 | 2018-11-02 | IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X… |
CVE-2018-17922 | Critical | 9.8 | 2018-11-02 | Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authenti… |
CVE-2018-1788 | Medium | 4.1 | 2018-11-02 | IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873. |
CVE-2018-17447 | High | 7.5 | 2018-10-23 | An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-15763 | Critical | 9.0 | 2018-10-05 | Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A mali… |
CVE-2018-1264 | Critical | 9.1 | 2018-10-05 | Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained acces… |
CVE-2018-0504 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid |
CVE-2018-16049 | Critical | 9.8 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Discl… |
CVE-2018-1768 | Medium | 5.6 | 2018-09-26 | IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may… |
CVE-2018-3828 | High | 7.5 | 2018-09-19 | Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would… |
CVE-2018-3827 | High | 8.1 | 2018-09-19 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin… |
CVE-2018-1223 | High | 8.8 | 2018-09-17 | Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the a… |
CVE-2018-1198 | High | 8.8 | 2018-09-17 | Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs c… |
CVE-2018-6599 | Medium | 5.5 | 2018-08-29 | An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sensitive information… |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-7754 | Medium | 5.5 | 2018-08-10 | The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address informatio… |