CWE-532 · Insertion of Sensitive Information into Log File (page 9)
Page 9 of 13 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23141 | High | 7.5 | 2022-07-15 | ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attack… |
CVE-2022-34826 | Medium | 5.9 | 2022-07-15 | In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs. |
CVE-2022-33911 | Medium | 5.3 | 2022-07-12 | An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized… |
CVE-2022-33697 | Low | 3.3 | 2022-07-12 | Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permissi… |
CVE-2022-33693 | Low | 2.0 | 2022-07-12 | Exposure of Sensitive Information in CID Manager prior to SMR Jul-2022 Release 1 allows local attacker to access iccid via log. |
CVE-2022-33688 | Low | 3.3 | 2022-07-12 | Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permis… |
CVE-2022-33687 | Low | 3.3 | 2022-07-12 | Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log. |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-20768 | Medium | 4.9 | 2022-07-06 | A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and RoomOS Software could allow an authenticated, remote attacker to… |
CVE-2022-33737 | High | 7.5 | 2022-07-06 | The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin… |
CVE-2022-31098 | Critical | 9.0 | 2022-06-27 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in… |
CVE-2022-20651 | Medium | 5.5 | 2022-06-22 | A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive inform… |
CVE-2022-30148 | Medium | 5.5 | 2022-06-15 | Windows Desired State Configuration (DSC) Information Disclosure Vulnerability |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-32254 | Medium | 4.3 | 2022-06-14 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write… |
CVE-2022-32565 | High | 7.5 | 2022-06-13 | An issue was discovered in Couchbase Server before 7.0.4. The Backup Service log leaks unredacted usernames and document ids. |
CVE-2022-32193 | Medium | 6.5 | 2022-06-13 | Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitive Information to an Unauthorized Actor. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2021-43271 | Medium | 6.8 | 2022-06-03 | Riverbed AppResponse 11.8.0, 11.8.5, 11.8.5a, 11.9.0, 11.9.0a, 11.10.0, 11.11.0, 11.11.0a, 11.11.1, 11.11.1a, 11.11.5, and 11.11.5a (when configured to use loc… |
CVE-2022-20807 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20806 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20809 | Medium | 4.3 | 2022-05-26 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-29928 | Medium | 4.4 | 2022-05-12 | In JetBrains TeamCity before 2022.04 leak of secrets in TeamCity agent logs was possible |
CVE-2022-28161 | Medium | 5.5 | 2022-05-09 | An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to v… |
CVE-2022-28859 | Medium | 6.5 | 2022-05-05 | On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and neths… |
CVE-2022-27636 | Medium | 5.5 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2022-29869 | Medium | 5.3 | 2022-04-28 | cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. |
CVE-2021-38939 | Medium | 5.3 | 2022-04-27 | IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Fo… |
CVE-2022-29810 | Medium | 5.5 | 2022-04-27 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. |
CVE-2022-27888 | Medium | 5.5 | 2022-04-26 | Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fix… |
CVE-2022-24875 | Medium | 5.3 | 2022-04-21 | The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code w… |
CVE-2022-26907 | Medium | 5.3 | 2022-04-15 | Azure SDK for .NET Information Disclosure Vulnerability |
CVE-2022-1157 | Low | 2.6 | 2022-04-11 | Missing sanitization of logged exception messages in all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 of GitLab CE/EE causes potent… |
CVE-2021-45103 | High | 8.1 | 2022-04-06 | An issue was discovered in HTCondor 9.0.x before 9.0.10 and 9.1.x before 9.5.1. An attacker can access files stored in S3 cloud storage that a user has asked H… |
CVE-2022-27442 | High | 7.5 | 2022-04-04 | TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password. |
CVE-2022-24758 | High | 7.5 | 2022-03-31 | The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive informatio… |
CVE-2021-39739 | Low | 3.3 | 2022-03-30 | In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with Sy… |
CVE-2022-27192 | High | 7.5 | 2022-03-23 | The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can im… |
CVE-2022-24757 | High | 7.5 | 2022-03-23 | The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized… |
CVE-2022-25518 | Medium | 6.5 | 2022-03-22 | In CMDBuild from version 3.0 to 3.3.2 payload requests are saved in a temporary log table, which allows attackers with database access to read the password of… |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2021-39715 | Medium | 4.4 | 2022-03-16 | In __show_regs of process.c, there is a possible leak of kernel memory and addresses due to log information disclosure. This could lead to local information di… |
CVE-2021-20180 | Medium | 5.5 | 2022-03-16 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbu… |
CVE-2022-25830 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25829 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp… |
CVE-2022-25828 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25827 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp i… |
CVE-2022-25826 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in t… |
CVE-2022-25823 | Low | 1.9 | 2022-03-10 | Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log. |
CVE-2022-0725 | High | 7.5 | 2022-03-10 | A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability… |
CVE-2021-41543 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Climatix POL909 (AWB module) (All versions < V11.44), Climatix POL909 (AWM module) (All versions < V11.36). The handling… |
CVE-2021-25009 | Medium | 5.3 | 2022-03-07 | The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver… |
CVE-2022-25374 | High | 7.5 | 2022-02-25 | HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensiti… |
CVE-2022-20630 | Medium | 4.4 | 2022-02-10 | A vulnerability in the audit log of Cisco DNA Center could allow an authenticated, local attacker to view sensitive information in clear text. This vulnerabili… |
CVE-2022-0021 | Low | 3.3 | 2022-02-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the… |
CVE-2022-22939 | Medium | 4.9 | 2022-02-04 | VMware Cloud Foundation contains an information disclosure vulnerability due to logging of credentials in plain-text within multiple log files on the SDDC Mana… |
CVE-2021-36289 | High | 7.8 | 2022-01-25 | Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulner… |
CVE-2022-0338 | Medium | 4.3 | 2022-01-25 | Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. |
CVE-2021-41808 | Low | 2.0 | 2022-01-18 | In M-Files Server product with versions before 21.11.10775.0, enabling logging of Federated authentication to event log wrote sensitive information to log. Mit… |
CVE-2022-22703 | Medium | 5.5 | 2022-01-17 | In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer. |
CVE-2021-44234 | Medium | 5.5 | 2022-01-14 | SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitiv… |
CVE-2021-39032 | Medium | 5.5 | 2022-01-14 | IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID… |
CVE-2021-45449 | Medium | 5.5 | 2022-01-12 | Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only af… |
CVE-2021-45034 | High | 7.5 | 2022-01-11 | A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < V16.20), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions… |
CVE-2021-34797 | High | 7.5 | 2022-01-04 | Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters… |
CVE-2021-36318 | Medium | 6.7 | 2021-12-21 | Dell EMC Avamar versions 18.2,19.1,19.2,19.3,19.4 contain a plain-text password storage vulnerability. A high privileged user could potentially exploit this vu… |
CVE-2021-0997 | Medium | 5.5 | 2021-12-15 | In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to l… |
CVE-2021-0991 | Low | 2.4 | 2021-12-15 | In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information discl… |
CVE-2021-37861 | Medium | 5.8 | 2021-12-09 | Mattermost 6.0.2 and earlier fails to sufficiently sanitize user's password in audit logs when user creation fails. |
CVE-2021-34800 | High | 7.5 | 2021-11-29 | Sensitive information could be logged. The following products are affected: Acronis Agent (Windows, Linux, macOS) before build 27147 |
CVE-2021-21561 | High | 7.8 | 2021-11-23 | Dell PowerScale OneFS version 8.1.2 contains a sensitive information exposure vulnerability. This would allow a malicious user with ISI_PRIV_LOGIN_SSH and/or I… |
CVE-2021-37036 | Medium | 5.5 | 2021-11-23 | There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific informa… |
CVE-2021-36340 | High | 7.8 | 2021-11-20 | Dell EMC SCG 5.00.00.10 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read se… |
CVE-2021-22030 | Medium | 6.5 | 2021-11-19 | In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs… |
CVE-2021-27026 | Medium | 4.4 | 2021-11-18 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged |
CVE-2021-0148 | Medium | 4.4 | 2021-11-17 | Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information disclosure via local… |
CVE-2021-3791 | Medium | 6.5 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same… |
CVE-2021-40364 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2020-10052 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames… |
CVE-2021-39913 | Medium | 4.4 | 2021-11-05 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, a… |
CVE-2021-20129 | High | 7.5 | 2021-10-13 | An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs. |
CVE-2021-39900 | Low | 2.0 | 2021-10-04 | Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availabi… |
CVE-2021-39246 | Medium | 6.1 | 2021-09-24 | Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamp… |
CVE-2021-23046 | Medium | 4.9 | 2021-09-14 | On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configura… |
CVE-2021-32724 | Critical | 9.9 | 2021-09-09 | check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.c… |
CVE-2021-32801 | Medium | 5.5 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive k… |
CVE-2021-27022 | Medium | 4.9 | 2021-09-07 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-27019 | Medium | 4.3 | 2021-08-30 | PuppetDB logging included potentially sensitive system information. |
CVE-2021-22024 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network acces… |
CVE-2021-39291 | High | 8.8 | 2021-08-23 | Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected… |
CVE-2021-37709 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of… |
CVE-2021-36278 | High | 8.1 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with… |
CVE-2021-21601 | High | 8.8 | 2021-08-10 | Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CIS. A local low privi… |
CVE-2021-21598 | Low | 3.9 | 2021-08-10 | Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability. An authenticated attacker with physical access to t… |
CVE-2021-21597 | High | 7.2 | 2021-08-10 | Dell Wyse ThinOS, version 9.0, contains a Sensitive Information Disclosure Vulnerability. An authenticated malicious user with physical access to the system co… |
CVE-2021-26999 | Medium | 4.3 | 2021-08-06 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to a… |
CVE-2021-26998 | Medium | 4.3 | 2021-08-06 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled shoul… |