CWE-532 · Insertion of Sensitive Information into Log File (page 4)
Page 4 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24520 | Low | 3.3 | 2025-08-12 | Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2514.7.16.0 may allow an authenticated u… |
CVE-2025-42935 | Medium | 4.1 | 2025-08-12 | The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local acces… |
CVE-2025-8864 | | 2025-08-11 | Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs | |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2025-54781 | Low | 2.8 | 2025-08-02 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tas… |
CVE-2025-23289 | Medium | 5.5 | 2025-07-31 | NVIDIA Omniverse Launcher for Windows and Linux contains a vulnerability in the launcher logs, where a user could cause sensitive information to be written to… |
CVE-2025-30105 | High | 8.8 | 2025-07-30 | Dell XtremIO, version(s) 6.4.0-22, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access co… |
CVE-2025-26332 | High | 8.8 | 2025-07-30 | TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged at… |
CVE-2025-43225 | Medium | 5.5 | 2025-07-30 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7… |
CVE-2025-53649 | Medium | 5.1 | 2025-07-29 | "SwitchBot" App for iOS/Android contains an insertion of sensitive information into log file vulnerability in versions V6.24 through V9.12. If this vulnerabili… |
CVE-2025-54120 | | 2025-07-23 | PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the… | |
CVE-2025-43485 | Medium | 4.5 | 2025-07-23 | A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could potentially allow a p… |
CVE-2025-7371 | Medium | 6.8 | 2025-07-22 | Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with acc… |
CVE-2025-52580 | Low | 2.4 | 2025-07-22 | Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be… |
CVE-2025-54319 | Medium | 6.3 | 2025-07-20 | An issue was discovered in Westermo WeOS 5 (5.24 through 5.24.4). A threat actor potentially can gain unauthorized access to sensitive information via system l… |
CVE-2025-6391 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with securit… |
CVE-2025-51497 | Medium | 5.5 | 2025-07-17 | An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active… |
CVE-2025-54064 | | 2025-07-17 | Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The com… | |
CVE-2025-30483 | Medium | 5.5 | 2025-07-15 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged at… |
CVE-2025-53886 | Medium | 4.5 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-53885 | Medium | 4.2 | 2025-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flo… |
CVE-2025-6392 | Medium | 4.4 | 2025-07-10 | Brocade SANnav before Brocade SANnav 2.4.0a could log database passwords in clear text in audit logs when the daily data dump collector invokes docker exec com… |
CVE-2025-36599 | Medium | 4.3 | 2025-07-09 | Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker wit… |
CVE-2025-5464 | Medium | 6.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that inform… |
CVE-2025-5463 | Medium | 5.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a l… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2024-9453 | Medium | 6.5 | 2025-07-04 | A vulnerability was found in Red Hat OpenShift Jenkins. The bearer token is not obfuscated in the logs and potentially carries a high risk if those logs are ce… |
CVE-2025-49846 | | 2025-07-03 | wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have… | |
CVE-2025-6587 | | 2025-07-03 | System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensit… | |
CVE-2025-6624 | High | 7.2 | 2025-06-26 | Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Re… |
CVE-2025-52893 | Medium | 4.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2024-7586 | Medium | 4.1 | 2025-06-20 | An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prio… |
CVE-2025-36050 | Medium | 6.2 | 2025-06-19 | IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 stores potentially sensitive information in log files that could be read by a local user. |
CVE-2025-50200 | Medium | 5.5 | 2025-06-19 | RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When quer… |
CVE-2025-2327 | | 2025-06-16 | A flaw exists in FlashArray whereby the Key Encryption Key (KEK) is logged during key rotation when RDL is configured. | |
CVE-2025-36573 | High | 7.1 | 2025-06-12 | Dell Smart Dock Firmware, versions prior to 01.00.08.01, contain an Insertion of Sensitive Information into Log File vulnerability. A user with local access co… |
CVE-2025-49009 | Medium | 6.2 | 2025-06-05 | Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 in `FacebookAuthFi… |
CVE-2025-48493 | Medium | 6.5 | 2025-06-05 | The Yii 2 Redis extension provides the redis key-value store support for the Yii framework 2.0. On failing connection, the extension writes commands sequence t… |
CVE-2025-48955 | Medium | 6.2 | 2025-06-02 | Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both acces… |
CVE-2025-31199 | Medium | 5.5 | 2025-05-29 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, macOS Sonoma 14.8.2, visionOS… |
CVE-2025-46777 | Low | 2.3 | 2025-05-28 | A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may a… |
CVE-2025-48374 | | 2025-05-22 | zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 (corresponding to pseudove… | |
CVE-2025-26864 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache Io… |
CVE-2025-26795 | High | 7.5 | 2025-05-14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This i… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2025-31213 | High | 7.6 | 2025-05-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-3911 | | 2025-04-29 | Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive i… | |
CVE-2025-4090 | Medium | 5.3 | 2025-04-29 | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefo… |
CVE-2025-46329 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information… |
CVE-2025-46614 | Low | 3.3 | 2025-04-28 | In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information i… |
CVE-2025-46432 | Medium | 4.3 | 2025-04-25 | In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs |
CVE-2025-2092 | High | 7.5 | 2025-04-22 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication… |
CVE-2025-2300 | Medium | 5.5 | 2025-04-22 | Hitachi Ops Center Common Services within Hitachi Ops Center OVA contains an information exposure vulnerability. This issue affects Hitachi Ops Center Common S… |
CVE-2025-24651 | Medium | 5.9 | 2025-04-17 | Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration wp-migration-duplicator allows Retrieve Embedded Sensi… |
CVE-2025-32382 | | 2025-04-10 | Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a pa… | |
CVE-2025-32016 | Medium | 4.7 | 2025-04-09 | Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity… |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2025-30677 | Medium | 6.5 | 2025-04-09 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Ad… |
CVE-2025-25013 | Medium | 6.5 | 2025-04-08 | Improper restriction of environment variables in Elastic Defend can lead to exposure of sensitive information such as API keys and tokens via automatic transmi… |
CVE-2025-25002 | Medium | 6.8 | 2025-04-08 | Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network. |
CVE-2025-32054 | Low | 3.3 | 2025-04-03 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file |
CVE-2025-31479 | High | 8.2 | 2025-04-02 | canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if… |
CVE-2025-31788 | Medium | 5.3 | 2025-04-01 | Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-pe… |
CVE-2024-7577 | Medium | 4.4 | 2025-03-29 | IBM InfoSphere Information Server 11.7 could disclose sensitive user credentials from log files during new installation of the product. |
CVE-2025-1998 | Medium | 5.5 | 2025-03-27 | IBM UrbanCode Deploy (UCD) through 7.1.2.21, 7.2 through 7.2.3.14, and 7.3 through 7.3.2.0 / IBM DevOps Deploy 8.0 through 8.0.1.4 and 8.1 through 8.1 stores… |
CVE-2025-31139 | Medium | 4.3 | 2025-03-27 | In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2025-20231 | High | 7.1 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-30205 | High | 7.6 | 2025-03-24 | kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrument… |
CVE-2025-0495 | | 2025-03-17 | Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute valu… | |
CVE-2024-40585 | Medium | 6.5 | 2025-03-14 | An insertion of sensitive information into log file vulnerabilities [CWE-532] in FortiManager version 7.4.0, version 7.2.3 and below, version 7.0.8 and below… |
CVE-2025-27496 | Low | 3.3 | 2025-03-13 | Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versi… |
CVE-2025-2002 | Medium | 6.0 | 2025-03-12 | CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials when the FTP server i… |
CVE-2025-24984 | Medium | 4.6 | 2025-03-11 | Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2025-0071 | Medium | 4.9 | 2025-03-11 | SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter… |
CVE-2025-1296 | Medium | 6.5 | 2025-03-10 | Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. T… |
CVE-2025-1696 | | 2025-03-06 | A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs… | |
CVE-2025-1979 | Medium | 6.4 | 2025-03-06 | Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the st… |
CVE-2024-45674 | Low | 3.3 | 2025-02-22 | IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gat… |
CVE-2024-13818 | Medium | 5.3 | 2025-02-21 | The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress… |
CVE-2025-1075 | High | 7.5 | 2025-02-19 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be writ… |
CVE-2025-1053 | Medium | 4.9 | 2025-02-14 | Under certain error conditions at time of SANnav installation or upgrade, the encryption key can be written into and obtained from a Brocade SANnav supportsave… |
CVE-2022-35202 | Medium | 5.1 | 2025-02-11 | A security issue in Sitevision version 10.3.1 and older allows a remote attacker, in certain (non-default) scenarios, to gain access to the private keys used f… |
CVE-2024-13416 | Medium | 4.3 | 2025-02-06 | Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log. 2N has released an updated ve… |
CVE-2024-57957 | Medium | 6.6 | 2025-02-06 | Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2025-23413 | Medium | 4.4 | 2025-02-05 | When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. N… |
CVE-2025-24556 | High | 7.5 | 2025-02-03 | Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWo… |
CVE-2025-23374 | High | 8.0 | 2025-01-30 | Dell Networking Switches running Enterprise SONiC OS, version(s) prior to 4.4.1 and 4.2.3, contain(s) an Insertion of Sensitive Information into Log File vulne… |
CVE-2025-24884 | | 2025-01-29 | kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the "full-elastic-stack" example vector configuration was used for a real c… | |
CVE-2024-48852 | Critical | 9.4 | 2025-01-29 | Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This i… |
CVE-2025-0736 | Medium | 5.5 | 2025-01-28 | A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as c… |
CVE-2025-24169 | High | 7.5 | 2025-01-27 | A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass brows… |
CVE-2025-24145 | Low | 3.3 | 2025-01-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An app… |
CVE-2024-54519 | Medium | 5.5 | 2025-01-27 | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2. An app may be able to read sensitive location inf… |
CVE-2025-24389 | Medium | 6.3 | 2025-01-27 | Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system… |
CVE-2023-38271 | Medium | 4.3 | 2025-01-25 | IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could allow an authen… |
CVE-2025-24362 | | 2025-01-24 | In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the w… | |
CVE-2025-24034 | Low | 3.2 | 2025-01-23 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau i… |
CVE-2025-24457 | Medium | 5.5 | 2025-01-21 | In JetBrains YouTrack before 2024.3.55417 permanent tokens could be exposed in logs |
CVE-2024-45091 | Medium | 6.2 | 2025-01-21 | IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that coul… |