CWE-532 · Insertion of Sensitive Information into Log File (page 8)
Page 8 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39876 | Medium | 5.9 | 2022-10-07 | Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. |
CVE-2022-39874 | Medium | 4.0 | 2022-10-07 | Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-23716 | Medium | 5.3 | 2022-09-28 | A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in t… |
CVE-2022-32217 | Medium | 5.3 | 2022-09-23 | A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-39821 | High | 7.5 | 2022-09-13 | In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical informati… |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-34369 | High | 8.1 | 2022-09-02 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files… |
CVE-2022-28625 | Medium | 5.5 | 2022-08-31 | A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locall… |
CVE-2022-39046 | High | 7.5 | 2022-08-31 | An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitial… |
CVE-2022-0718 | Medium | 4.9 | 2022-08-29 | A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any… |
CVE-2021-32570 | Medium | 4.9 | 2022-08-26 | In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All… |
CVE-2022-23715 | Medium | 6.5 | 2022-08-25 | A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings… |
CVE-2022-29550 | Medium | 5.5 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for exa… |
CVE-2022-38149 | High | 7.5 | 2022-08-17 | HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute met… |
CVE-2022-20278 | Medium | 5.5 | 2022-08-12 | In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information d… |
CVE-2022-31674 | Medium | 4.3 | 2022-08-10 | VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lea… |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-29071 | Medium | 4.0 | 2022-08-05 | This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of c… |
CVE-2022-31119 | Low | 3.1 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the ev… |
CVE-2022-31186 | Low | 3.3 | 2022-08-01 | NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2`… |
CVE-2022-34570 | High | 7.5 | 2022-07-25 | WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the mess… |
CVE-2022-32556 | High | 7.5 | 2022-07-21 | An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes. |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |
CVE-2022-23141 | High | 7.5 | 2022-07-15 | ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attack… |
CVE-2022-34826 | Medium | 5.9 | 2022-07-15 | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. |
CVE-2022-33911 | Medium | 5.3 | 2022-07-12 | An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized… |
CVE-2022-33697 | Low | 3.3 | 2022-07-12 | Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permissi… |
CVE-2022-33693 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. |
CVE-2022-33688 | Low | 3.3 | 2022-07-12 | Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permis… |
CVE-2022-33687 | Low | 3.3 | 2022-07-12 | Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log. |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-20768 | Medium | 4.9 | 2022-07-06 | A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to… |
CVE-2022-33737 | High | 7.5 | 2022-07-06 | The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin… |
CVE-2022-31098 | Critical | 9.0 | 2022-06-27 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in… |
CVE-2022-20651 | Medium | 5.5 | 2022-06-22 | A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive inform… |
CVE-2022-30148 | Medium | 5.5 | 2022-06-15 | Windows Desired State Configuration (DSC) Information Disclosure Vulnerability |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-32254 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write… |
CVE-2022-32565 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. |
CVE-2022-32193 | Medium | 6.5 | 2022-06-13 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2021-43271 | Medium | 6.8 | 2022-06-03 | Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use loc… |
CVE-2022-20807 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20806 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20809 | Medium | 4.3 | 2022-05-26 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-29928 | Medium | 4.4 | 2022-05-12 | In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible |
CVE-2022-28161 | Medium | 5.5 | 2022-05-09 | An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to v… |
CVE-2022-28859 | Medium | 6.5 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and neths… |
CVE-2022-27636 | Medium | 5.5 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-29869 | Medium | 5.3 | 2022-04-28 | cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. |
CVE-2021-38939 | Medium | 5.3 | 2022-04-27 | IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Fo… |
CVE-2022-29810 | Medium | 5.5 | 2022-04-27 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. |
CVE-2022-27888 | Medium | 5.5 | 2022-04-26 | Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fix… |
CVE-2022-24875 | Medium | 5.3 | 2022-04-21 | The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code w… |
CVE-2022-26907 | Medium | 5.3 | 2022-04-15 | Azure SDK for .NET Information Disclosure Vulnerability |
CVE-2022-1157 | Low | 2.6 | 2022-04-11 | Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potent… |
CVE-2021-45103 | High | 8.1 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked H… |
CVE-2022-27442 | High | 7.5 | 2022-04-04 | TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password. |
CVE-2022-24758 | High | 7.5 | 2022-03-31 | The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive informatio… |
CVE-2021-39739 | Low | 3.3 | 2022-03-30 | In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with Sy… |
CVE-2022-27192 | High | 7.5 | 2022-03-23 | The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can im… |
CVE-2022-24757 | High | 7.5 | 2022-03-23 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized… |
CVE-2022-25518 | Medium | 6.5 | 2022-03-22 | In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of… |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2021-39715 | Medium | 4.4 | 2022-03-16 | In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information di… |
CVE-2021-20180 | Medium | 5.5 | 2022-03-16 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbu… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2021-41543 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling… |
CVE-2021-25009 | Medium | 5.3 | 2022-03-07 | The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver… |
CVE-2022-25374 | High | 7.5 | 2022-02-25 | HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensiti… |
CVE-2022-20630 | Medium | 4.4 | 2022-02-10 | A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerabili… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-22939 | Medium | 4.9 | 2022-02-04 | VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Mana… |
CVE-2021-36289 | High | 7.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulner… |
CVE-2022-0338 | Medium | 4.3 | 2022-01-25 | Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. |
CVE-2021-41808 | Low | 2.0 | 2022-01-18 | In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mit… |
CVE-2022-22703 | Medium | 5.5 | 2022-01-17 | In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer. |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2021-39032 | Medium | 5.5 | 2022-01-14 | IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID… |
CVE-2021-45449 | Medium | 5.5 | 2022-01-12 | Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only af… |
CVE-2021-45034 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2021-34797 | High | 7.5 | 2022-01-04 | Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters… |
CVE-2021-36318 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vu… |
CVE-2021-0997 | Medium | 5.5 | 2021-12-15 | In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to l… |
CVE-2021-0991 | Low | 2.4 | 2021-12-15 | In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information discl… |
CVE-2021-37861 | Medium | 5.8 | 2021-12-09 | Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails. |
CVE-2021-34800 | High | 7.5 | 2021-11-29 | Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147 |
CVE-2021-21561 | High | 7.8 | 2021-11-23 | Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or I… |
CVE-2021-37036 | Medium | 5.5 | 2021-11-23 | There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific informa… |
CVE-2021-36340 | High | 7.8 | 2021-11-20 | Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read se… |