CWE-532 · Insertion of Sensitive Information into Log File (page 7)
Page 7 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-51408 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and… |
CVE-2023-52146 | Medium | 5.3 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0. |
CVE-2023-52143 | High | 7.5 | 2024-01-05 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1… |
CVE-2023-50253 | Critical | 9.6 | 2024-01-03 | Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the nee… |
CVE-2023-46742 | Medium | 4.8 | 2024-01-03 | CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in mul… |
CVE-2023-6064 | High | 7.5 | 2024-01-01 | The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactio… |
CVE-2023-6802 | High | 7.2 | 2023-12-21 | An insertion of sensitive information into the log file in the audit log in GitHub Enterprise Server was identified that could allow an attacker to gain access… |
CVE-2023-6746 | High | 8.1 | 2023-12-21 | An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could pe… |
CVE-2023-1904 | Medium | 4.2 | 2023-12-14 | In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server. |
CVE-2023-46675 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error or in the event where debug level logg… |
CVE-2023-46671 | High | 8.0 | 2023-12-13 | An issue was discovered by Elastic whereby sensitive information may be recorded in Kibana logs in the event of an error. Elastic has released Kibana 8.11.1 wh… |
CVE-2023-6687 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to Elasticsea… |
CVE-2023-49922 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby Beats and Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that event to… |
CVE-2023-49923 | Medium | 6.8 | 2023-12-12 | An issue was discovered by Elastic whereby the Documents API of App Search logged the raw contents of indexed documents at INFO log level. Depending on the co… |
CVE-2023-36649 | Critical | 9.1 | 2023-12-12 | Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other use… |
CVE-2023-6460 | Medium | 4.0 | 2023-12-04 | A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be loggi… |
CVE-2023-6287 | Low | 3.3 | 2023-11-27 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-48708 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw… |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-25682 | Medium | 6.2 | 2023-11-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that cou… |
CVE-2021-22143 | Low | 2.1 | 2023-11-22 | The Elastic APM .NET Agent can leak sensitive HTTP header information when logging the details during an application error. Normally, the APM agent will saniti… |
CVE-2023-46672 | High | 8.4 | 2023-11-15 | An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifest… |
CVE-2023-32283 | Medium | 5.5 | 2023-11-14 | Insertion of sensitive information into log file in some Intel(R) On Demand software before versions 1.16.2, 2.1.1, 3.1.0 may allow an authenticated user to po… |
CVE-2022-46647 | Low | 2.2 | 2023-11-14 | Insertion of sensitive information into log file for some Intel Unison software may allow an authenticated user to potentially enable information disclosure vi… |
CVE-2023-45585 | Low | 2.3 | 2023-11-14 | An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, vers… |
CVE-2023-47390 | High | 7.5 | 2023-11-11 | Headscale through 0.22.3 writes bearer tokens to info-level logs. |
CVE-2023-0436 | Medium | 4.5 | 2023-11-07 | The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBU… |
CVE-2023-46255 | Medium | 4.2 | 2023-10-31 | SpiceDB is an open source, Google Zanzibar-inspired database for creating and managing security-critical application permissions. Prior to version 1.27.0-rc1… |
CVE-2023-21387 | Medium | 4.4 | 2023-10-30 | In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure. This could lead to lo… |
CVE-2023-46215 | High | 7.5 | 2023-10-28 | Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text w… |
CVE-2023-31417 | Medium | 4.1 | 2023-10-26 | Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied whe… |
CVE-2023-31422 | Critical | 9.0 | 2023-10-26 | An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.1… |
CVE-2023-46667 | High | 8.1 | 2023-10-26 | An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text… |
CVE-2023-46668 | Medium | 4.6 | 2023-10-26 | If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent… |
CVE-2023-42857 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app… |
CVE-2023-41254 | Medium | 5.5 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 a… |
CVE-2023-40425 | Medium | 4.4 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14, macOS Monterey 12.7.1. An app with… |
CVE-2023-40405 | Low | 3.3 | 2023-10-25 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensit… |
CVE-2023-44483 | Medium | 6.5 | 2023-10-20 | All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a priva… |
CVE-2023-45825 | Medium | 5.5 | 2023-10-19 | ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of… |
CVE-2023-45809 | Low | 2.7 | 2023-10-19 | Wagtail is an open source content management system built on Django. A user with a limited-permission editor account for the Wagtail admin can make a direct UR… |
CVE-2023-5339 | Medium | 4.7 | 2023-10-17 | Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password ent… |
CVE-2023-40682 | Medium | 4.4 | 2023-10-13 | IBM App Connect Enterprise 12.0.1.0 through 12.0.8.0 contains an unspecified vulnerability that could allow a local privileged user to obtain sensitive informa… |
CVE-2023-41263 | Low | 3.7 | 2023-10-12 | An issue was discovered in Plixer Scrutinizer before 19.3.1. It exposes debug logs to unauthenticated users at the /debug/ URL path. With knowledge of valid IP… |
CVE-2023-25604 | Medium | 5.5 | 2023-10-10 | An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RAD… |
CVE-2023-5499 | High | 7.5 | 2023-10-10 | Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in… |
CVE-2023-43485 | Medium | 5.5 | 2023-10-10 | When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which h… |
CVE-2023-41253 | Medium | 5.5 | 2023-10-10 | When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software ver… |
CVE-2023-39447 | Medium | 4.4 | 2023-10-10 | When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log. Note: Software versions which have… |
CVE-2023-5182 | Medium | 5.5 | 2023-10-07 | Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwo… |
CVE-2023-45241 | Medium | 5.5 | 2023-10-05 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739… |
CVE-2023-4380 | Medium | 6.3 | 2023-10-04 | A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw a… |
CVE-2023-43261 | High | 7.5 | 2023-10-04 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. |
CVE-2023-3350 | High | 8.2 | 2023-10-03 | A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve t… |
CVE-2023-3349 | High | 8.2 | 2023-10-03 | Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as us… |
CVE-2023-3335 | Medium | 6.5 | 2023-10-03 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Administrator on Linux allows local users to gain sensitive information.T… |
CVE-2023-44155 | High | 7.5 | 2023-09-27 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect 15 (Linux, Windows) before build 35979. |
CVE-2023-41308 | High | 7.5 | 2023-09-27 | Screenshot vulnerability in the input module. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2023-5028 | Low | 2.0 | 2023-09-17 | A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown fu… |
CVE-2023-40442 | Low | 3.3 | 2023-09-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8… |
CVE-2022-27599 | Medium | 6.7 | 2023-09-08 | An insertion of sensitive information into Log file vulnerability has been reported to affect product. If exploited, the vulnerability possibly provides local… |
CVE-2023-40029 | Critical | 9.9 | 2023-09-07 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a resul… |
CVE-2023-40392 | Low | 3.3 | 2023-09-06 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.5. An app may be able to read sensi… |
CVE-2023-41934 | Medium | 5.3 | 2023-09-06 | Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specifi… |
CVE-2023-30721 | Medium | 4.4 | 2023-09-06 | Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker to get lock screen… |
CVE-2023-4688 | Medium | 5.5 | 2023-08-31 | Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433. |
CVE-2021-32050 | Medium | 4.2 | 2023-08-29 | Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published ev… |
CVE-2023-39348 | Medium | 4.0 | 2023-08-28 | Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommend… |
CVE-2023-38733 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from i… |
CVE-2023-38732 | Medium | 4.3 | 2023-08-22 | IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force… |
CVE-2023-40338 | Medium | 4.3 | 2023-08-16 | Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attempting to access the Sca… |
CVE-2023-32491 | Medium | 6.3 | 2023-08-16 | Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3. A low privileges user could potentially e… |
CVE-2020-24804 | Medium | 6.5 | 2023-08-11 | Plaintext Password vulnerability in AddAdmin.py in cms-dev/cms v1.4.rc1, allows attackers to gain sensitive information via audit logs. |
CVE-2023-4108 | Medium | 4.5 | 2023-08-11 | Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged |
CVE-2023-36494 | Medium | 4.4 | 2023-08-02 | Audit logs on F5OS-A may contain undisclosed sensitive information. Note: Software versions which have reached End of Technical Support (EoTS) are not evalua… |
CVE-2023-3993 | Medium | 4.9 | 2023-08-02 | An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions… |
CVE-2023-31426 | Medium | 6.8 | 2023-08-01 | The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords… |
CVE-2023-32468 | Medium | 5.8 | 2023-07-26 | Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. A remote malicious high-privileged use… |
CVE-2023-20891 | Medium | 6.5 | 2023-07-26 | The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex enc… |
CVE-2023-32478 | Critical | 9.0 | 2023-07-21 | Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A high privileged malicious user could po… |
CVE-2023-32455 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-32447 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device… |
CVE-2023-32446 | Medium | 5.5 | 2023-07-20 | Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local acce… |
CVE-2023-26026 | Medium | 5.3 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2023-26023 | Medium | 6.5 | 2023-07-19 | Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to con… |
CVE-2023-37224 | Medium | 6.0 | 2023-07-14 | An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information via the log files. |
CVE-2023-3363 | Low | 3.9 | 2023-07-13 | An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 1… |
CVE-2023-20207 | Medium | 4.9 | 2023-07-12 | A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacker to view sensitive information in clear… |
CVE-2023-38067 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log |
CVE-2023-38064 | Medium | 4.3 | 2023-07-12 | In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log |
CVE-2023-35695 | High | 7.5 | 2023-06-26 | A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file which may contain sensit… |
CVE-2023-32392 | Medium | 5.5 | 2023-06-23 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Bi… |
CVE-2023-20885 | Medium | 6.5 | 2023-06-16 | Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versi… |
CVE-2023-26207 | Low | 3.3 | 2023-06-13 | An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7… |
CVE-2023-2878 | Medium | 6.5 | 2023-06-07 | Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs. |
CVE-2023-34097 | High | 7.8 | 2023-06-05 | hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database co… |
CVE-2023-34223 | Medium | 4.3 | 2023-05-31 | In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some cases |
CVE-2023-28351 | Low | 3.3 | 2023-05-31 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is log… |
CVE-2022-0010 | High | 7.8 | 2023-05-22 | Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has… |
CVE-2023-33001 | High | 7.5 | 2023-05-16 | Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode… |