CWE-532 · Insertion of Sensitive Information into Log File (page 3)
Page 3 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47979 | Medium | 5.5 | 2025-10-14 | Insertion of sensitive information into log file in Windows Failover Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-31514 | Low | 2.7 | 2025-10-14 | A insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4 all versions, FortiOS 7.2 all versions, F… |
CVE-2025-37727 | Medium | 5.7 | 2025-10-10 | Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the… |
CVE-2025-10645 | Medium | 5.3 | 2025-10-07 | The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method… |
CVE-2023-50301 | Low | 1.9 | 2025-10-01 | IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-36144 | Low | 3.3 | 2025-09-27 | IBM Lakehouse (watsonx.data 2.2) stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-9985 | Medium | 5.3 | 2025-09-26 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through pub… |
CVE-2025-34188 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 1.0.735 and Application prior to 20.0.1330 (macOS/Linux client deployments) conta… |
CVE-2025-34183 | High | 7.5 | 2025-09-16 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains a vulnerability in its server-side logging mechanism that allows unauthenticated remote attackers to retr… |
CVE-2025-43354 | Medium | 5.5 | 2025-09-15 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An a… |
CVE-2025-43303 | Medium | 5.5 | 2025-09-15 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An a… |
CVE-2025-4234 | | 2025-09-12 | A problem with the Palo Alto Networks Cortex XDR Microsoft 365 Defender Pack can result in exposure of user credentials in application logs. Normally, these ap… | |
CVE-2025-54376 | High | 7.5 | 2025-09-10 | Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same… |
CVE-2025-43888 | High | 8.8 | 2025-09-10 | Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privil… |
CVE-2025-10221 | Medium | 5.5 | 2025-09-10 | Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft Axxon One / AxxonNet / C-WerkNet 2.0.4 and earlier on Window… |
CVE-2025-7445 | Medium | 6.5 | 2025-09-05 | Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs. |
CVE-2025-23261 | Medium | 5.5 | 2025-09-04 | NVIDIA Cumulus Linux and NVOS products contain a vulnerability, where hashed user passwords are not properly suppressed in log files, potentially disclosing in… |
CVE-2025-8663 | Medium | 6.5 | 2025-09-03 | Insertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper Manager allows Use of Known Domain Credentials.This issue affects… |
CVE-2025-41690 | High | 7.4 | 2025-09-02 | A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. Thi… |
CVE-2025-36133 | Medium | 5.9 | 2025-09-01 | IBM App Connect Enterprise Certified Container CD: 9.2.0 through 11.6.0, 12.1.0 through 12.14.0, and 12.0 LTS: 12.0.0 through 12.0.14stores potentially sensiti… |
CVE-2025-57813 | Medium | 5.9 | 2025-08-26 | traQ is a messenger application built for Digital Creators Club traP. Prior to version 3.25.0, a vulnerability exists where sensitive information, such as OAut… |
CVE-2025-3456 | Low | 3.8 | 2025-08-25 | On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowl… |
CVE-2025-7426 | | 2025-08-25 | Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote ac… | |
CVE-2025-55285 | Low | 2.6 | 2025-08-15 | @backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values… |
CVE-2025-38745 | Medium | 4.8 | 2025-08-14 | Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Rest… |
CVE-2025-24520 | Low | 3.3 | 2025-08-12 | Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2514.7.16.0 may allow an authenticated u… |
CVE-2025-42935 | Medium | 4.1 | 2025-08-12 | The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local acces… |
CVE-2025-8864 | | 2025-08-11 | Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs | |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2025-54781 | Low | 2.8 | 2025-08-02 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tas… |
CVE-2025-23289 | Medium | 5.5 | 2025-07-31 | NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to… |
CVE-2025-30105 | High | 8.8 | 2025-07-30 | Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access co… |
CVE-2025-26332 | High | 8.8 | 2025-07-30 | TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged at… |
CVE-2025-43225 | Medium | 5.5 | 2025-07-30 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-53649 | Medium | 5.1 | 2025-07-29 | "SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerabili… |
CVE-2025-54120 | | 2025-07-23 | PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the… | |
CVE-2025-43485 | Medium | 4.5 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a p… |
CVE-2025-7371 | Medium | 6.8 | 2025-07-22 | Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with acc… |
CVE-2025-52580 | Low | 2.4 | 2025-07-22 | Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be… |
CVE-2025-54319 | Medium | 6.3 | 2025-07-20 | An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system l… |
CVE-2025-6391 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with securit… |
CVE-2025-51497 | Medium | 5.5 | 2025-07-17 | An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active… |
CVE-2025-54064 | | 2025-07-17 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The com… | |
CVE-2025-30483 | Medium | 5.5 | 2025-07-15 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged at… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53885 | Medium | 4.2 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-6392 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec com… |
CVE-2025-36599 | Medium | 4.3 | 2025-07-09 | Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker wit… |
CVE-2025-5464 | Medium | 6.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that inform… |
CVE-2025-5463 | Medium | 5.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a l… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2024-9453 | Medium | 6.5 | 2025-07-04 | A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are ce… |
CVE-2025-49846 | | 2025-07-03 | wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have… | |
CVE-2025-6587 | | 2025-07-03 | System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensit… | |
CVE-2025-6624 | High | 7.2 | 2025-06-26 | Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Re… |
CVE-2025-52893 | Medium | 4.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2024-7586 | Medium | 4.1 | 2025-06-20 | An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2025-36050 | Medium | 6.2 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-50200 | Medium | 5.5 | 2025-06-19 | RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When quer… |
CVE-2025-2327 | | 2025-06-16 | A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured. | |
CVE-2025-36573 | High | 7.1 | 2025-06-12 | Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access co… |
CVE-2025-49009 | Medium | 6.2 | 2025-06-05 | Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFi… |
CVE-2025-48493 | Medium | 6.5 | 2025-06-05 | The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence t… |
CVE-2025-48955 | Medium | 6.2 | 2025-06-02 | Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both acces… |
CVE-2025-31199 | Medium | 5.5 | 2025-05-29 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS… |
CVE-2025-46777 | Low | 2.3 | 2025-05-28 | A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may a… |
CVE-2025-48374 | | 2025-05-22 | zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudove… | |
CVE-2025-26864 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache Io… |
CVE-2025-26795 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This i… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2025-31213 | High | 7.6 | 2025-05-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-3911 | | 2025-04-29 | Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive i… | |
CVE-2025-4090 | Medium | 5.3 | 2025-04-29 | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefo… |
CVE-2025-46329 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information… |
CVE-2025-46614 | Low | 3.3 | 2025-04-28 | In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information i… |
CVE-2025-46432 | Medium | 4.3 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
CVE-2025-2092 | High | 7.5 | 2025-04-22 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication… |
CVE-2025-2300 | Medium | 5.5 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability. This issue affects Hitachi Ops Center Common S… |
CVE-2025-24651 | Medium | 5.9 | 2025-04-17 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensi… |
CVE-2025-32382 | | 2025-04-10 | Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a pa… | |
CVE-2025-32016 | Medium | 4.7 | 2025-04-09 | Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity… |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2025-30677 | Medium | 6.5 | 2025-04-09 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Ad… |
CVE-2025-25013 | Medium | 6.5 | 2025-04-08 | Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmi… |
CVE-2025-25002 | Medium | 6.8 | 2025-04-08 | Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network. |
CVE-2025-32054 | Low | 3.3 | 2025-04-03 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
CVE-2025-31479 | High | 8.2 | 2025-04-02 | canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if… |
CVE-2025-31788 | Medium | 5.3 | 2025-04-01 | Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-pe… |
CVE-2024-7577 | Medium | 4.4 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. |
CVE-2025-1998 | Medium | 5.5 | 2025-03-27 | IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores… |
CVE-2025-31139 | Medium | 4.3 | 2025-03-27 | In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2025-20231 | High | 7.1 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-30205 | High | 7.6 | 2025-03-24 | kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrument… |
CVE-2025-0495 | | 2025-03-17 | Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute valu… | |
CVE-2024-40585 | Medium | 6.5 | 2025-03-14 | An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below… |
CVE-2025-27496 | Low | 3.3 | 2025-03-13 | Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versi… |
CVE-2025-2002 | Medium | 6.0 | 2025-03-12 | CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server i… |
CVE-2025-24984 | Medium | 4.6 | 2025-03-11 | Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2025-0071 | Medium | 4.9 | 2025-03-11 | SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter… |