CWE-532 · Insertion of Sensitive Information into Log File (page 5)
Page 5 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-11923 | Medium | 5.5 | 2025-01-18 | Under certain log settings the IAM or CORE service will log credentials in the iam logfile in Fortra Application Hub (Formerly named Helpsystems One) prior to… |
CVE-2024-12226 | Medium | 6.5 | 2025-01-16 | In affected versions of the Octopus Kubernetes worker or agent, sensitive variables could be written to the Kubernetes script pod log in clear-text. This was i… |
CVE-2024-55891 | Low | 3.1 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the pa… |
CVE-2025-21323 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21321 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21320 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21319 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21318 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21317 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2025-21316 | Medium | 5.5 | 2025-01-14 | Windows Kernel Memory Information Disclosure Vulnerability |
CVE-2024-40679 | Medium | 5.5 | 2025-01-08 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be… |
CVE-2025-22275 | Critical | 9.3 | 2025-01-03 | iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.t… |
CVE-2024-12569 | High | 7.8 | 2024-12-19 | Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credential… |
CVE-2024-49816 | Medium | 4.9 | 2024-12-17 | IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local pr… |
CVE-2024-12292 | Medium | 4.0 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-54484 | Medium | 5.5 | 2024-12-12 | The issue was resolved by sanitizing logging. This issue is fixed in macOS Sequoia 15.2. An app may be able to access user-sensitive data. |
CVE-2024-42407 | High | 8.5 | 2024-12-12 | Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to v… |
CVE-2024-12057 | | 2024-12-09 | User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with t… | |
CVE-2024-55578 | Medium | 4.3 | 2024-12-09 | Zammad before 6.4.1 places sensitive data (such as auth_microsoft_office365_credentials and application_secret) in log files. |
CVE-2024-42196 | Medium | 6.2 | 2024-12-06 | HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. |
CVE-2024-47094 | Medium | 5.5 | 2024-11-29 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p22, <2.2.0p37, <2.1.0p50 (EOL) causes remote site secrets to be writ… |
CVE-2024-52067 | Medium | 4.9 | 2024-11-21 | Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization proc… |
CVE-2022-43937 | Medium | 5.7 | 2024-11-21 | Possible information exposure through log file vulnerability where sensitive fields are recorded in the debug-enabled logs when debugging is turned on in Broca… |
CVE-2022-43936 | Medium | 6.8 | 2024-11-21 | Brocade SANnav versions before 2.2.2 log Brocade Fabric OS switch passwords when debugging is enabled. |
CVE-2022-43935 | Medium | 5.3 | 2024-11-21 | An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where Brocade Fabric OS Switch passwords and autho… |
CVE-2022-43933 | Medium | 4.4 | 2024-11-21 | An information exposure through log file vulnerability exists in Brocade SANnav before Brocade SANnav 2.2.2, where configuration secrets are logged in supports… |
CVE-2024-52940 | High | 7.5 | 2024-11-18 | AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must… |
CVE-2024-11193 | Medium | 6.5 | 2024-11-13 | An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in plaintext within application logs. This flaw res… |
CVE-2024-11165 | | 2024-11-13 | An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversi… | |
CVE-2024-52009 | Critical | 9.8 | 2024-11-08 | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `gh… |
CVE-2024-51753 | | 2024-11-05 | The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In affected versions ref… | |
CVE-2024-51752 | Medium | 5.5 | 2024-11-05 | The AuthKit library for Next.js provides convenient helpers for authentication and session management using WorkOS & AuthKit with Next.js. In affected versions… |
CVE-2024-51528 | Medium | 4.0 | 2024-11-05 | Vulnerability of improper log printing in the Super Home Screen module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2024-10544 | Medium | 5.3 | 2024-10-31 | The Woo Manage Fraud Orders plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.1 through publicly e… |
CVE-2024-44239 | Medium | 5.5 | 2024-10-28 | An information disclosure issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18… |
CVE-2024-27849 | Low | 3.3 | 2024-10-28 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to read sensiti… |
CVE-2024-49750 | Medium | 5.5 | 2024-10-24 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2024-44205 | Medium | 5.5 | 2024-10-24 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17… |
CVE-2023-22649 | High | 8.4 | 2024-10-16 | A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. [Rancher Audit Logging](https://ranchermanager.doc… |
CVE-2024-45739 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes plaintext passwords for local native authentication Splunk users… |
CVE-2024-45738 | Medium | 4.9 | 2024-10-14 | In Splunk Enterprise versions below 9.3.1, 9.2.3, and 9.1.6, the software potentially exposes sensitive HTTP parameters to the `_internal` index. This exposure… |
CVE-2024-38862 | Medium | 4.4 | 2024-10-14 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p18, <2.2.0p35, <2.1.0p48 and <=2.0.0p39 (EOL) causes SNMP and IMPI s… |
CVE-2024-8264 | Medium | 5.5 | 2024-10-09 | Fortra's Robot Schedule Enterprise Agent prior to version 3.05 writes FTP username and password information to the agent log file when detailed logging is enab… |
CVE-2024-9466 | Medium | 6.5 | 2024-10-09 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, pass… |
CVE-2024-47822 | Medium | 4.2 | 2024-10-08 | Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed… |
CVE-2024-9621 | Medium | 5.3 | 2024-10-08 | A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. Th… |
CVE-2024-47913 | Medium | 5.3 | 2024-10-04 | An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can… |
CVE-2024-20491 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive informatio… |
CVE-2024-20490 | Medium | 6.3 | 2024-10-02 | A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker wi… |
CVE-2024-8609 | High | 7.5 | 2024-09-27 | Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: be… |
CVE-2023-46175 | Medium | 4.4 | 2024-09-26 | IBM Cloud Pak for Multicloud Management 2.3 through 2.3 FP8 stores user credentials in a log file plain clear text which can be read by a privileged user. |
CVE-2022-49037 | Medium | 6.5 | 2024-09-26 | Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authentica… |
CVE-2024-47083 | High | 7.5 | 2024-09-25 | Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Pl… |
CVE-2024-7421 | Medium | 5.5 | 2024-09-25 | An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers with access to system logs to obtain se… |
CVE-2024-43990 | Medium | 5.3 | 2024-09-25 | Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a t… |
CVE-2024-44166 | Medium | 5.5 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 1… |
CVE-2024-40791 | Low | 3.3 | 2024-09-17 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macO… |
CVE-2024-8775 | Medium | 5.5 | 2024-09-14 | A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occ… |
CVE-2024-4472 | Medium | 4.0 | 2024-09-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 p… |
CVE-2022-26322 | Medium | 4.9 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. Th… |
CVE-2021-22533 | Medium | 6.5 | 2024-09-12 | Possible Insertion of Sensitive Information into Log File Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.4.0000. |
CVE-2021-22518 | Medium | 5.8 | 2024-09-12 | A vulnerability identified in OpenText™ Identity Manager AzureAD Driver that allows logging of sensitive information into log file. This impacts all versions… |
CVE-2024-43781 | Medium | 5.5 | 2024-09-10 | A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Cr… |
CVE-2024-42344 | Medium | 4.4 | 2024-09-10 | A vulnerability has been identified in SINEMA Remote Connect Client (All versions < V3.2 SP2). The affected application inserts sensitive information into a lo… |
CVE-2024-20440 | High | 7.5 | 2024-09-04 | A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due… |
CVE-2024-8365 | Medium | 6.2 | 2024-09-02 | Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifi… |
CVE-2024-43444 | High | 8.2 | 2024-08-26 | Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match… |
CVE-2024-42056 | Medium | 6.5 | 2024-08-22 | Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be… |
CVE-2024-6451 | High | 7.2 | 2024-08-19 | AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file exten… |
CVE-2024-41719 | Medium | 4.2 | 2024-08-14 | When generating QKView of BIG-IP Next instance from the BIG-IP Next Central Manager (CM), F5 iHealth credentials will be logged in the BIG-IP Central Manager… |
CVE-2024-41978 | Medium | 6.5 | 2024-08-13 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2024-37930 | Medium | 5.3 | 2024-08-12 | Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMa… |
CVE-2024-37283 | Medium | 6.5 | 2024-08-12 | An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By defa… |
CVE-2024-40096 | Low | 3.3 | 2024-08-05 | The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log. |
CVE-2024-37286 | Medium | 5.7 | 2024-08-03 | APM server logs contain document body from a partially failed bulk index request. For example, in case of unavailable_shards_exception for a specific document… |
CVE-2024-38321 | Medium | 5.3 | 2024-08-03 | IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 stores potentially sensitive information in log files under certain situations that could b… |
CVE-2024-42349 | Medium | 5.3 | 2024-08-02 | FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored d… |
CVE-2024-6687 | Medium | 5.3 | 2024-08-01 | The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-c… |
CVE-2024-6977 | Medium | 6.5 | 2024-07-31 | A vulnerability in Cato Networks SDP Client on Windows allows the insertion of sensitive information into the log file, which can lead to an account takeover… |
CVE-2023-49921 | Medium | 5.2 | 2024-07-26 | An issue was discovered by Elastic whereby Watcher search input logged the search query results on DEBUG log level. This could lead to raw contents of document… |
CVE-2024-41178 | High | 7.5 | 2024-07-23 | Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebId… |
CVE-2024-41824 | Medium | 6.4 | 2024-07-22 | In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases |
CVE-2024-41129 | Medium | 4.4 | 2024-07-22 | The ops library is a Python framework for developing and testing Kubernetes and machine charms. The issue here is that ops passes the secret content as one of… |
CVE-2024-0006 | | 2024-07-19 | Information exposure in the logging system in Yugabyte Platform allows local attackers with access to application logs to obtain database user credentials in l… | |
CVE-2024-40636 | Medium | 5.3 | 2024-07-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized… |
CVE-2024-39532 | Medium | 6.3 | 2024-07-11 | An Insertion of Sensitive Information into Log File vulnerability in Juniper Networks Junos OS and Junos OS Evolved allows a local, authenticated attacker with… |
CVE-2024-37270 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1… |
CVE-2024-37205 | Medium | 5.3 | 2024-07-10 | Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4. |
CVE-2024-27784 | High | 8.8 | 2024-07-09 | Multiple Exposure of sensitive information to an unauthorized actor weaknesses [CWE-200] vulnerability in Fortinet FortiAIOps 2.0.0 may allow an authenticated… |
CVE-2024-40598 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted att… |
CVE-2024-40596 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log even… |
CVE-2022-25477 | Medium | 5.5 | 2024-07-02 | Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sys) before 10.0.22000.21355 and Realtek RtsUer driver for USB Card Reader (RtsUer.sys) bef… |
CVE-2024-32757 | Medium | 6.8 | 2024-07-02 | Under certain circumstances unnecessary user details are provided within system logs |
CVE-2024-22276 | Medium | 5.3 | 2024-06-27 | VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjacent access to web/p… |
CVE-2023-30430 | Medium | 5.5 | 2024-06-27 | IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace logs. IBM X-Force ID: 252183. |
CVE-2024-39460 | Medium | 4.3 | 2024-06-26 | Jenkins Bitbucket Branch Source Plugin 886.v44cf5e4ecec5 and earlier prints the Bitbucket OAuth access token as part of the Bitbucket URL in the build log in s… |
CVE-2024-28830 | Low | 2.7 | 2024-06-26 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p7, <2.2.0p28, <2.1.0p45 and <=2.0.0p39 (EOL) causes automation user… |
CVE-2024-29177 | Low | 2.7 | 2024-06-26 | Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain a disclosure of temporary sensitive information vulnerability. A… |
CVE-2024-29954 | Medium | 5.9 | 2024-06-26 | A vulnerability in a password management API in Brocade Fabric OS versions before v9.2.1, v9.2.0b, v9.1.1d, and v8.2.3e prints sensitive information in log fil… |
CVE-2024-6060 | | 2024-06-25 | An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain… |