CWE-532 · Insertion of Sensitive Information into Log File (page 12)
Page 12 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-10358 | Medium | 6.5 | 2019-07-31 | Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the bu… |
CVE-2019-10345 | Medium | 5.5 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export. |
CVE-2019-10343 | Low | 3.3 | 2019-07-31 | Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being appli… |
CVE-2019-10165 | Low | 2.3 | 2019-07-30 | OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A… |
CVE-2019-0202 | High | 7.5 | 2019-07-26 | The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating… |
CVE-2019-14268 | Medium | 6.5 | 2019-07-25 | In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a… |
CVE-2019-11273 | Medium | 4.3 | 2019-07-23 | Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and… |
CVE-2019-13098 | Medium | 6.5 | 2019-07-22 | The user password via the registration form of TronLink Wallet 2.2.0 is stored in the log when the class CreateWalletTwoActivity is called. Other authenticated… |
CVE-2019-13509 | High | 7.5 | 2019-07-18 | In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add sec… |
CVE-2019-10194 | Medium | 5.5 | 2019-07-11 | Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclose… |
CVE-2018-19583 | Medium | 6.5 | 2019-07-10 | GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse logs, permitting adm… |
CVE-2019-4299 | Medium | 5.5 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is ena… |
CVE-2019-4296 | Low | 3.3 | 2019-07-01 | IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log… |
CVE-2019-1622 | Medium | 5.3 | 2019-06-27 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve s… |
CVE-2019-4225 | Medium | 4.4 | 2019-06-26 | IBM PureApplication System 2.2.3.0 through 2.2.5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 15… |
CVE-2019-11271 | High | 7.8 | 2019-06-19 | Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database… |
CVE-2019-3888 | Critical | 9.8 | 2019-06-12 | A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeR… |
CVE-2019-9929 | High | 8.8 | 2019-06-06 | Northern.tech CFEngine Enterprise 3.12.1 has Insecure Permissions. |
CVE-2019-11336 | High | 8.1 | 2019-05-14 | Sony Bravia Smart TV devices allow remote attackers to retrieve the static Wi-Fi password (used when the TV is acting as an access point) by using the Photo Sh… |
CVE-2019-6158 | High | 8.7 | 2019-05-03 | An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in clear text. This on… |
CVE-2019-11492 | High | 7.5 | 2019-04-26 | ProjectSend before r1070 writes user passwords to the server logs. |
CVE-2019-9734 | High | 7.5 | 2019-04-24 | Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain c… |
CVE-2019-9724 | High | 7.5 | 2019-04-24 | aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component. |
CVE-2019-6157 | Medium | 6.5 | 2019-04-22 | In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's priva… |
CVE-2015-1343 | Low | 2.0 | 2019-04-22 | All versions of unity-scope-gdrive logs search terms to syslog. |
CVE-2019-3891 | High | 7.8 | 2019-04-15 | It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Candlepin database. A… |
CVE-2019-9976 | High | 8.8 | 2019-04-11 | The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the… |
CVE-2019-0032 | High | 7.8 | 2019-04-10 | A password management issue exists where the Organization authentication username and password were stored in plaintext in log files. A locally authenticated a… |
CVE-2019-4143 | Medium | 5.5 | 2019-04-08 | The IBM Cloud Private Key Management Service (IBM Cloud Private 3.1.1 and 3.1.2) could allow a local user to obtain sensitive from the KMS plugin container log… |
CVE-2019-3830 | High | 7.8 | 2019-03-26 | A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log file… |
CVE-2018-16856 | Medium | 5.5 | 2019-03-26 | In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.201810… |
CVE-2019-7612 | Critical | 9.8 | 2019-03-25 | A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of… |
CVE-2018-19513 | High | 7.5 | 2019-03-21 | In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file… |
CVE-2018-18466 | High | 7.0 | 2019-03-21 | An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credential… |
CVE-2018-17499 | Low | 2.9 | 2019-03-21 | Envoy Passport for Android and Envoy Passport for iPhone could allow a local attacker to obtain sensitive information, caused by the storing of unencrypted dat… |
CVE-2019-3716 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA… |
CVE-2019-3715 | High | 7.8 | 2019-03-13 | RSA Archer versions, prior to 6.5 SP1, contain an information exposure vulnerability. Users' session information is logged in plain text in the RSA Archer log… |
CVE-2019-0741 | High | 7.5 | 2019-03-05 | An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnera… |
CVE-2019-8944 | Medium | 6.5 | 2019-02-20 | An Information Exposure issue in the Terraform deployment step in Octopus Deploy before 2019.1.8 (and before 2018.10.4 LTS) allows remote authenticated users t… |
CVE-2019-0266 | High | 7.5 | 2019-02-15 | Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file… |
CVE-2019-4008 | Critical | 9.8 | 2019-02-07 | API Connect V2018.1 through 2018.4.1.1 is impacted by access token leak. Authorization tokens in some URLs can result in the tokens being written to log files… |
CVE-2017-1198 | Low | 3.7 | 2019-02-05 | IBM BigFix Compliance 1.7 through 1.9.91 (TEMA SUAv1 SCA SCM) stores sensitive information in URL parameters. This may lead to information disclosure if unauth… |
CVE-2018-19014 | Medium | 6.5 | 2019-01-28 | Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Log files are access… |
CVE-2018-16889 | Medium | 5.5 | 2019-01-28 | Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption key information in log files via plaint… |
CVE-2019-0029 | High | 8.8 | 2019-01-15 | Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk ser… |
CVE-2019-0021 | High | 7.1 | 2019-01-15 | On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to v… |
CVE-2019-0004 | Medium | 5.5 | 2019-01-15 | On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operatio… |
CVE-2019-3500 | High | 7.8 | 2019-01-02 | aria2c in aria2 1.33.1, when --log is used, can store an HTTP Basic Authentication username and password in a file, which might allow local users to obtain sen… |
CVE-2018-15004 | Medium | 5.9 | 2018-12-28 | The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package nam… |
CVE-2018-15002 | Medium | 4.7 | 2018-12-28 | The Vivo V7 device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys allows any app co-located on the device to set syst… |
CVE-2018-15001 | Medium | 5.5 | 2018-12-28 | The Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys contains a platform app with a package name… |
CVE-2018-14995 | Medium | 4.7 | 2018-12-28 | The ZTE Blade Vantage Android device with a build fingerprint of ZTE/Z839/sweet:7.1.1/NMF26V/20180120.095344:user/release-keys, the ZTE Blade Spark Android dev… |
CVE-2018-19863 | Medium | 5.5 | 2018-12-22 | An issue was discovered in 1Password 7.2.3.BETA before 7.2.3.BETA-3 on macOS. A mistake in error logging resulted in instances where sensitive data passed from… |
CVE-2018-15797 | High | 8.4 | 2018-12-05 | Cloud Foundry NFS volume release, 1.2.x prior to 1.2.5, 1.5.x prior to 1.5.4, 1.7.x prior to 1.7.3, logs the cf admin username and password when running the nf… |
CVE-2018-19865 | High | 7.5 | 2018-12-05 | A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3. |
CVE-2018-19786 | High | 8.1 | 2018-12-05 | HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autos… |
CVE-2018-14700 | High | 7.5 | 2018-12-03 | Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL l… |
CVE-2018-16859 | Medium | 4.2 | 2018-11-29 | Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear i… |
CVE-2018-16095 | Medium | 5.9 | 2018-11-27 | In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. |
CVE-2018-1876 | Medium | 6.2 | 2018-11-02 | IBM Robotic Process Automation with Automation Anywhere 11 could under certain cases, display the password in a Control Room log file after installation. IBM X… |
CVE-2018-17922 | Critical | 9.8 | 2018-11-02 | Circontrol CirCarLife all versions prior to 4.3.1, the PAP credentials of the device are stored in clear text in a log file that is accessible without authenti… |
CVE-2018-1788 | Medium | 4.1 | 2018-11-02 | IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873. |
CVE-2018-17447 | High | 7.5 | 2018-10-23 | An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4. |
CVE-2018-15763 | Critical | 9.0 | 2018-10-05 | Pivotal Container Service, versions prior to 1.2.0, contains an information disclosure vulnerability which exposes IaaS credentials to application logs. A mali… |
CVE-2018-1264 | Critical | 9.1 | 2018-10-05 | Cloud Foundry Log Cache, versions prior to 1.1.1, logs its UAA client secret on startup as part of its envstruct report. A remote attacker who has gained acces… |
CVE-2018-0504 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid |
CVE-2018-16049 | Critical | 9.8 | 2018-10-03 | An issue was discovered in GitLab Community and Enterprise Edition before 11.0.6, 11.1.x before 11.1.5, and 11.2.x before 11.2.2. There is Sensitive Data Discl… |
CVE-2018-1768 | Medium | 5.6 | 2018-09-26 | IBM Spectrum Protect Plus 10.1.0 and 10.1.1 could disclose sensitive information when an authorized user executes a test operation, the user id an password may… |
CVE-2018-3828 | High | 7.5 | 2018-09-19 | Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would… |
CVE-2018-3827 | High | 8.1 | 2018-09-19 | A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin… |
CVE-2018-1223 | High | 8.8 | 2018-09-17 | Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the a… |
CVE-2018-1198 | High | 8.8 | 2018-09-17 | Pivotal Cloud Cache, versions prior to 1.3.1, prints a superuser password in plain text during BOSH deployment logs. A malicious user with access to the logs c… |
CVE-2018-6599 | Medium | 5.5 | 2018-08-29 | An issue was discovered on Orbic Wonder Orbic/RC555L/RC555L:7.1.2/N2G47H/329100b:user/release-keys devices, allowing attackers to obtain sensitive information… |
CVE-2018-3776 | Medium | 5.3 | 2018-08-12 | Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log. |
CVE-2018-7754 | Medium | 5.5 | 2018-08-10 | The aoedisk_debugfs_show function in drivers/block/aoe/aoeblk.c in the Linux kernel through 4.16.4rc4 allows local users to obtain sensitive address informatio… |
CVE-2018-1999036 | Medium | 6.5 | 2018-08-01 | An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH priva… |
CVE-2017-2621 | Medium | 5.5 | 2018-07-27 | An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory was improperly made… |
CVE-2017-15113 | High | 7.2 | 2018-07-27 | ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log leve… |
CVE-2018-6971 | High | 7.8 | 2018-07-25 | VMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure vulnerability due to insecure logging of credentials in the vmmsi.log fi… |
CVE-2018-11717 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depend… |
CVE-2018-11716 | Critical | 9.8 | 2018-07-16 | An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instan… |
CVE-2018-0042 | Critical | 9.8 | 2018-07-11 | Juniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an information disclosure vulnerability. |
CVE-2018-2440 | Medium | 4.4 | 2018-07-10 | Under certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy Controller versions 7.7 and 8.5) exposes sensitive information… |
CVE-2018-10889 | Medium | 4.3 | 2018-07-10 | A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other us… |
CVE-2017-1795 | Medium | 4.4 | 2018-07-06 | IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed Fil… |
CVE-2018-10855 | Medium | 5.9 | 2018-07-03 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive… |
CVE-2018-1072 | Medium | 5.0 | 2018-06-26 | ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files. When engine-backup was run with one of the options "--provi… |
CVE-2018-7682 | Medium | 6.5 | 2018-06-22 | Micro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful services across domains. |
CVE-2018-7683 | High | 7.5 | 2018-06-21 | Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files. |
CVE-2018-12604 | High | 7.5 | 2018-06-20 | GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. |
CVE-2018-1117 | Medium | 5.0 | 2018-06-20 | ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' pl… |
CVE-2018-1075 | Medium | 5.0 | 2018-06-12 | ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to pro… |
CVE-2018-0335 | High | 7.8 | 2018-06-07 | A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensi… |
CVE-2017-1480 | Medium | 4.3 | 2018-06-06 | IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read… |
CVE-2016-10526 | High | 8.6 | 2018-05-31 | A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In… |
CVE-2018-1241 | High | 8.8 | 2018-05-29 | Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-tex… |
CVE-2018-11320 | Critical | 9.8 | 2018-05-21 | In Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target do not have sensitive values obfuscated in the deployment logs. |
CVE-2017-2592 | Medium | 5.9 | 2018-05-08 | python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sens… |
CVE-2018-8719 | Medium | 5.3 | 2018-04-04 | An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted… |
CVE-2017-1733 | Medium | 4.0 | 2018-04-04 | IBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 134914. |