CWE-532 · Insertion of Sensitive Information into Log File (page 12)
Page 12 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1999036 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH priva… |
CVE-2017-2621 | Medium | 5.5 | 2018-07-27 | An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made… |
CVE-2017-15113 | High | 7.2 | 2018-07-27 | ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log leve… |
CVE-2018-6971 | High | 7.8 | 2018-07-25 | VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log fi… |
CVE-2018-11717 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depend… |
CVE-2018-11716 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instan… |
CVE-2018-0042 | Critical | 9.8 | 2018-07-11 | Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability. |
CVE-2018-2440 | Medium | 4.4 | 2018-07-10 | Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information… |
CVE-2018-10889 | Medium | 4.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other us… |
CVE-2017-1795 | Medium | 4.4 | 2018-07-06 | IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed Fil… |
CVE-2018-10855 | Medium | 5.9 | 2018-07-03 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive… |
CVE-2018-1072 | Medium | 5.0 | 2018-06-26 | ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provi… |
CVE-2018-7682 | Medium | 6.5 | 2018-06-22 | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
CVE-2018-7683 | High | 7.5 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
CVE-2018-12604 | High | 7.5 | 2018-06-20 | GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. |
CVE-2018-1117 | Medium | 5.0 | 2018-06-20 | ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' pl… |
CVE-2018-1075 | Medium | 5.0 | 2018-06-12 | ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to pro… |
CVE-2018-0335 | High | 7.8 | 2018-06-07 | A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensi… |
CVE-2017-1480 | Medium | 4.3 | 2018-06-06 | IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read… |
CVE-2016-10526 | High | 8.6 | 2018-05-31 | A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In… |
CVE-2018-1241 | High | 8.8 | 2018-05-29 | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-tex… |
CVE-2018-11320 | Critical | 9.8 | 2018-05-21 | In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs. |
CVE-2017-2592 | Medium | 5.9 | 2018-05-08 | python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sens… |
CVE-2018-8719 | Medium | 5.3 | 2018-04-04 | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted… |
CVE-2017-1733 | Medium | 4.0 | 2018-04-04 | IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 134914. |
CVE-2018-3817 | Medium | 6.5 | 2018-03-30 | When logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2 could inadvertently log sensitive information. |
CVE-2016-0898 | Critical | 10.0 | 2018-03-29 | MySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext. These credentials were logged to the Service Backup component l… |
CVE-2018-1350 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration. |
CVE-2018-1349 | Low | 2.3 | 2018-03-26 | The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration. |
CVE-2018-1000123 | Critical | 9.8 | 2018-03-13 | Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Through Log Files (CWE-5… |
CVE-2018-1000089 | High | 7.4 | 2018-03-13 | Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An a… |
CVE-2018-7204 | High | 7.5 | 2018-03-07 | inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt… |
CVE-2018-7433 | High | 7.5 | 2018-03-02 | The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page. |
CVE-2017-9278 | Low | 3.3 | 2018-03-02 | The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosing this to attacke… |
CVE-2017-7434 | Low | 3.3 | 2018-03-02 | In the JDBC driver of NetIQ Identity Manager before 4.6 sending out incorrect XML configurations could result in passwords being logged into exception logfiles. |
CVE-2017-9271 | Low | 3.3 | 2018-03-01 | The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used. |
CVE-2018-3609 | High | 8.1 | 2018-02-16 | A vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1 management portal could allow an unauthenticated user to access s… |
CVE-2018-2372 | Medium | 6.5 | 2018-02-14 | A plain keystore password is written to a system log file in SAP HANA Extended Application Services, 1.0, which could endanger confidentiality of SSL communica… |
CVE-2018-1000060 | Critical | 9.8 | 2018-02-09 | Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redac… |
CVE-2018-1000018 | High | 7.8 | 2018-01-24 | An information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's password in the log file. |
CVE-2018-5693 | Low | 3.3 | 2018-01-14 | The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog. |
CVE-2017-1727 | Medium | 4.3 | 2018-01-04 | IBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error messages that could aid an attacker in further attacks against the… |
CVE-2017-6139 | Medium | 5.9 | 2017-12-21 | In F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system appends log details when responding to client requests. Detai… |
CVE-2017-8001 | High | 8.4 | 2017-11-28 | An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed t… |
CVE-2017-16946 | Medium | 4.9 | 2017-11-25 | The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, which allows admins to discover a hashed pas… |
CVE-2017-7550 | Critical | 9.8 | 2017-11-21 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could… |
CVE-2017-1000171 | Critical | 9.8 | 2017-11-03 | Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text. |
CVE-2017-15366 | Critical | 9.8 | 2017-10-26 | Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. This password is left behi… |
CVE-2017-6165 | Critical | 9.8 | 2017-10-20 | In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5.1 HF6 through 11.5.4 HF4, 11.6.0 through 11.6.1 HF1, and 12.0… |
CVE-2017-15572 | High | 7.5 | 2017-10-18 | In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because acc… |
CVE-2017-0380 | Medium | 5.9 | 2017-09-18 | The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1… |
CVE-2017-11134 | Medium | 6.5 | 2017-08-01 | An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attack… |
CVE-2015-3243 | Medium | 5.5 | 2017-07-25 | rsyslog uses weak permissions for generating log files, which allows local users to obtain sensitive information by reading files in /var/log/cron. |
CVE-2017-6709 | Critical | 9.8 | 2017-07-06 | A vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to access administrative credentials… |
CVE-2017-9615 | Critical | 9.8 | 2017-06-26 | Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes th… |
CVE-2017-3744 | Medium | 6.5 | 2017-06-20 | In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) ser… |
CVE-2016-10362 | Medium | 6.5 | 2017-06-16 | Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials. |
CVE-2017-4955 | Critical | 9.8 | 2017-06-13 | An issue was discovered in Pivotal PCF Elastic Runtime 1.6.x versions prior to 1.6.65, 1.7.x versions prior to 1.7.48, 1.8.x versions prior to 1.8.28, and 1.9… |
CVE-2016-6799 | High | 7.5 | 2017-05-09 | Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i()… |
CVE-2017-8075 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "Switch Info" log lines where passwords are in cleartext. This affects the 1.1… |
CVE-2017-8074 | Critical | 9.8 | 2017-04-23 | On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from "SEND data" log lines where passwords are encoded in hexadecimal. This affects… |
CVE-2017-7214 | Critical | 9.8 | 2017-03-21 | An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification except… |
CVE-2016-9985 | Medium | 5.5 | 2017-03-08 | IBM Cognos Server 10.1.1 and 10.2 stores highly sensitive information in log files that could be read by a local user. IBM Reference #: 1999671. |
CVE-2016-8233 | Critical | 9.8 | 2017-03-01 | Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear text form that coul… |
CVE-2017-5153 | High | 7.8 | 2017-02-13 | An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated… |
CVE-2016-9344 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute fo… |
CVE-2016-8346 | High | 7.5 | 2017-02-13 | An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is… |
CVE-2017-5549 | Medium | 5.5 | 2017-02-06 | The klsi_105_get_line_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory contents into a log e… |
CVE-2017-5137 | Medium | 6.2 | 2017-02-05 | An issue was discovered on SendQuick Entera and Avera devices before 2HF16. An attacker could request and download the SMS logs from an unauthenticated perspec… |
CVE-2016-8912 | Medium | 4.3 | 2017-02-01 | IBM Kenexa LMS on Cloud 13.1 and 13.2 - 13.2.4 stores potentially sensitive information in in log files that could be read by an authenticated user. |
CVE-2016-0296 | Low | 3.3 | 2017-02-01 | IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user. |
CVE-2015-8977 | High | 7.5 | 2017-01-31 | MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via v… |
CVE-2016-9882 | High | 7.5 | 2017-01-13 | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. Cloud Foundry logs the creden… |
CVE-2016-4443 | Medium | 5.5 | 2016-12-14 | Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the… |
CVE-2016-2943 | Low | 1.9 | 2016-11-30 | IBM BigFix Remote Control before 9.1.3 allows local users to obtain sensitive information by leveraging unspecified privileges to read a log file. |
CVE-2016-2928 | Medium | 4.3 | 2016-11-25 | IBM BigFix Remote Control before 9.1.3 allows remote authenticated users to obtain sensitive information by reading error logs. |
CVE-2016-5967 | Medium | 5.5 | 2016-11-25 | The installation component in IBM Rational Asset Analyzer (RAA) 6.1.0 before FP10 allows local users to discover the WAS Admin password by reading IM native lo… |
CVE-2016-5432 | Low | 3.3 | 2016-10-03 | The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning inform… |
CVE-2016-0879 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 do not delete copies of configuration and log files after completing the import function, which allows remote… |
CVE-2016-0875 | High | 7.5 | 2016-05-31 | Moxa Secure Router EDR-G903 devices before 3.4.12 allow remote attackers to read configuration and log files via a crafted URL. |
CVE-2013-6384 | | 2013-11-23 | (1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceil… | |
CVE-2013-4733 | High | 7.5 | 2013-06-30 | The web server on the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 allows remote attack… |
CVE-2012-0814 | Medium | 6.5 | 2012-01-27 | The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allow… |
CVE-2011-1943 | | 2011-06-14 | The destroy_one_secret function in nm-setting-vpn.c in libnm-util in the NetworkManager package 0.8.999-3.git20110526 in Fedora 15 creates a log entry containi… | |
CVE-2001-1556 | | 2001-12-31 | The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote a… |