CWE-532 · Insertion of Sensitive Information into Log File (page 8)
Page 8 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2514 | Medium | 6.7 | 2023-05-12 | Mattermost Sever fails to redact the DB username and password before emitting an application log during server initialization. |
CVE-2023-22447 | Low | 2.0 | 2023-05-10 | Insertion of sensitive information into log file in the Open CAS software for Linux maintained by Intel before version 22.6.2 may allow a privileged user to po… |
CVE-2023-31413 | Low | 3.3 | 2023-05-04 | Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to b… |
CVE-2023-21492 | Medium | 4.4 | 2023-05-04 | Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. |
CVE-2023-31207 | Medium | 4.4 | 2023-05-02 | Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be wri… |
CVE-2023-1786 | Medium | 5.5 | 2023-04-26 | Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escal… |
CVE-2023-31056 | Critical | 9.1 | 2023-04-24 | CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employed. The fixed versi… |
CVE-2023-30618 | Low | 3.2 | 2023-04-21 | Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting in… |
CVE-2022-2084 | Medium | 5.5 | 2023-04-19 | Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed pass… |
CVE-2021-3429 | Medium | 5.5 | 2023-04-19 | When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var… |
CVE-2023-30610 | Medium | 5.5 | 2023-04-19 | aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation… |
CVE-2023-29002 | High | 7.2 | 2023-04-18 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the `cilium-… |
CVE-2023-23591 | Medium | 4.9 | 2023-04-12 | The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs when debug logging… |
CVE-2022-48228 | Medium | 5.5 | 2023-04-04 | An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka COR… |
CVE-2022-48435 | Low | 3.3 | 2023-04-04 | In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file |
CVE-2022-43772 | Low | 3.8 | 2023-04-03 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and passwo… |
CVE-2023-1550 | Medium | 5.5 | 2023-03-29 | Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log f… |
CVE-2023-25721 | Medium | 6.5 | 2023-03-28 | Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins glob… |
CVE-2023-28630 | Medium | 4.2 | 2023-03-27 | GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by admi… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2021-3684 | Medium | 5.5 | 2023-03-24 | A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installat… |
CVE-2023-28443 | Medium | 4.2 | 2023-03-24 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly… |
CVE-2023-28441 | High | 8.0 | 2023-03-24 | smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs… |
CVE-2023-20859 | Medium | 5.5 | 2023-03-23 | In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive inf… |
CVE-2023-25687 | Medium | 4.3 | 2023-03-21 | IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow an authenticated user to obtain sensitive information from log files… |
CVE-2023-22481 | Medium | 4.0 | 2023-03-06 | FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where… |
CVE-2023-23505 | Low | 3.3 | 2023-02-27 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9… |
CVE-2022-43923 | Medium | 6.2 | 2023-02-24 | IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: 241584. |
CVE-2023-0815 | Medium | 6.8 | 2023-02-23 | Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and… |
CVE-2022-43870 | Medium | 6.5 | 2023-02-22 | IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540. |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |
CVE-2022-43954 | Medium | 4.3 | 2023-02-16 | An insertion of sensitive information into log file vulnerability [CWE-532] in the FortiPortal management interface 7.0.0 through 7.0.2 may allow a remote auth… |
CVE-2023-22362 | High | 7.5 | 2023-02-13 | SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Af… |
CVE-2023-21435 | Medium | 4.4 | 2023-02-09 | Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via… |
CVE-2023-25163 | Medium | 6.3 | 2023-02-08 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug whic… |
CVE-2023-25164 | High | 8.6 | 2023-02-08 | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store… |
CVE-2023-24827 | Medium | 6.5 | 2023-02-07 | syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was fo… |
CVE-2022-42439 | Medium | 6.8 | 2023-02-06 | IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which… |
CVE-2021-36544 | High | 7.5 | 2023-02-03 | Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. |
CVE-2023-22575 | High | 8.7 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potenti… |
CVE-2023-22574 | High | 8.1 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privil… |
CVE-2023-22573 | High | 7.9 | 2023-02-01 | Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. A low privileged local attacker c… |
CVE-2023-22572 | High | 7.8 | 2023-02-01 | Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local… |
CVE-2022-45098 | Medium | 6.1 | 2023-02-01 | Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. An authenticated local attacker co… |
CVE-2022-3902 | Medium | 5.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions star… |
CVE-2022-20458 | Medium | 5.5 | 2023-01-26 | The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() cou… |
CVE-2021-39011 | Medium | 4.2 | 2023-01-20 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM… |
CVE-2023-22733 | Low | 2.7 | 2023-01-17 | Shopware is an open source commerce platform based on Symfony Framework and Vue js. In affected versions the log module would write out all kind of sent mails… |
CVE-2022-23506 | Medium | 4.3 | 2023-01-03 | Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine image… |
CVE-2022-4858 | Medium | 4.4 | 2022-12-30 | Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configur… |
CVE-2022-43887 | Medium | 5.3 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain… |
CVE-2022-38756 | Medium | 4.3 | 2022-12-16 | A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent tha… |
CVE-2022-4311 | Medium | 4.7 | 2022-12-12 | An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log f… |
CVE-2022-33187 | Medium | 5.5 | 2022-12-09 | Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to re… |
CVE-2022-23469 | Low | 3.5 | 2022-12-08 | Traefik is an open source HTTP reverse proxy and load balancer. Versions prior to 2.9.6 are subject to a potential vulnerability in Traefik displaying the Auth… |
CVE-2022-39897 | Medium | 4.4 | 2022-12-08 | Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. |
CVE-2022-2721 | High | 7.5 | 2022-11-25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verb… |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |
CVE-2022-43673 | Medium | 4.7 | 2022-11-18 | Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppD… |
CVE-2022-27895 | Medium | 4.2 | 2022-11-15 | Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was… |
CVE-2022-27896 | Medium | 4.2 | 2022-11-14 | Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log re… |
CVE-2022-35719 | Medium | 5.1 | 2022-11-14 | IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be read by a local user. |
CVE-2022-39893 | Low | 3.3 | 2022-11-09 | Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers with log access per… |
CVE-2022-44745 | Medium | 5.5 | 2022-11-07 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107. |
CVE-2022-27893 | Medium | 4.2 | 2022-11-04 | The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This v… |
CVE-2021-44862 | High | 8.4 | 2022-11-03 | Netskope client is impacted by a vulnerability where an authenticated, local attacker can view sensitive information stored in NSClient logs which should be re… |
CVE-2022-44624 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters |
CVE-2022-41553 | Medium | 6.5 | 2022-11-01 | Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi… |
CVE-2022-3191 | Medium | 6.6 | 2022-11-01 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local u… |
CVE-2022-3499 | Medium | 6.5 | 2022-10-31 | An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of… |
CVE-2022-3018 | Medium | 6.8 | 2022-10-28 | An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4… |
CVE-2022-31239 | Medium | 6.7 | 2022-10-21 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.19, 9.2.1.12, and 9.3.0.6, contain sensitive data in log files vulnerability. A privileged loca… |
CVE-2022-31684 | Medium | 4.3 | 2022-10-19 | Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid acc… |
CVE-2022-3293 | Low | 3.5 | 2022-10-17 | Email addresses were leaked in WebHook logs in GitLab EE affecting all versions from 9.3 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1 |
CVE-2022-39876 | Medium | 5.9 | 2022-10-07 | Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. |
CVE-2022-39874 | Medium | 4.0 | 2022-10-07 | Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-23716 | Medium | 5.3 | 2022-09-28 | A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in t… |
CVE-2022-32217 | Medium | 5.3 | 2022-09-23 | A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-39821 | High | 7.5 | 2022-09-13 | In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical informati… |
CVE-2022-36877 | Low | 2.8 | 2022-09-09 | Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attac… |
CVE-2022-34369 | High | 8.1 | 2022-09-02 | Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files… |
CVE-2022-28625 | Medium | 5.5 | 2022-08-31 | A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locall… |
CVE-2022-39046 | High | 7.5 | 2022-08-31 | An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitial… |
CVE-2022-0718 | Medium | 4.9 | 2022-08-29 | A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any… |
CVE-2021-32570 | Medium | 4.9 | 2022-08-26 | In Ericsson Network Manager (ENM) releases before 21.2, users belonging to the same AMOS authorization group can retrieve the data from certain log files. All… |
CVE-2022-23715 | Medium | 6.5 | 2022-08-25 | A flaw was discovered in ECE before 3.4.0 that might lead to the disclosure of sensitive information such as user passwords and Elasticsearch keystore settings… |
CVE-2022-29550 | Medium | 5.5 | 2022-08-18 | An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for exa… |
CVE-2022-38149 | High | 7.5 | 2022-08-17 | HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute met… |
CVE-2022-20278 | Medium | 5.5 | 2022-08-12 | In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information d… |
CVE-2022-31674 | Medium | 4.3 | 2022-08-10 | VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lea… |
CVE-2022-38133 | Low | 3.2 | 2022-08-10 | In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases |
CVE-2022-29071 | Medium | 4.0 | 2022-08-05 | This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of c… |
CVE-2022-31119 | Low | 3.1 | 2022-08-04 | Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions of Nextcloud mail would log user passwords to disk in the ev… |
CVE-2022-31186 | Low | 3.3 | 2022-08-01 | NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2`… |
CVE-2022-34570 | High | 7.5 | 2022-07-25 | WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the mess… |
CVE-2022-32556 | High | 7.5 | 2022-07-21 | An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes. |
CVE-2022-36321 | Medium | 4.1 | 2022-07-20 | In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases |
CVE-2022-2394 | Medium | 4.1 | 2022-07-19 | Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, s… |