CWE-532 · Insertion of Sensitive Information into Log File (page 9)
Page 9 of 12 — CVEs classified under CWE-532, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-22030 | Medium | 6.5 | 2021-11-19 | In versions of Greenplum database prior to 5.28.14 and 6.17.0, certain statements execution led to the storage of sensitive(credential) information in the logs… |
CVE-2021-27026 | Medium | 4.4 | 2021-11-18 | A flaw was divered in Puppet Enterprise and other Puppet products where sensitive plan parameters may be logged |
CVE-2021-0148 | Medium | 4.4 | 2021-11-17 | Insertion of information into log file in firmware for some Intel(R) SSD DC may allow a privileged user to potentially enable information disclosure via local… |
CVE-2021-3791 | Medium | 6.5 | 2021-11-12 | An information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated attacker on the same… |
CVE-2021-40364 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2020-10052 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames… |
CVE-2021-39913 | Medium | 4.4 | 2021-11-05 | Accidental logging of system root password in the migration log in all versions of GitLab CE/EE before 14.2.6, all versions starting from 14.3 before 14.3.4, a… |
CVE-2021-20129 | High | 7.5 | 2021-10-13 | An information disclosure vulnerability exists in Draytek VigorConnect 1.6.0-B3, allowing an unauthenticated attacker to export system logs. |
CVE-2021-39900 | Low | 2.0 | 2021-10-04 | Information disclosure from SendEntry in GitLab starting with 10.8 allowed exposure of full URL of artifacts stored in object-storage with a temporary availabi… |
CVE-2021-39246 | Medium | 6.1 | 2021-09-24 | Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamp… |
CVE-2021-23046 | Medium | 4.9 | 2021-09-14 | On all versions of Guided Configuration before 8.0.0, when a configuration that contains secure properties is created and deployed from Access Guided Configura… |
CVE-2021-32724 | Critical | 9.9 | 2021-09-09 | check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling action](https://github.c… |
CVE-2021-32801 | Medium | 5.5 | 2021-09-07 | Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive k… |
CVE-2021-27022 | Medium | 4.9 | 2021-09-07 | A flaw was discovered in bolt-server and ace where running a task with sensitive parameters results in those sensitive parameters being logged when they should… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-27019 | Medium | 4.3 | 2021-08-30 | PuppetDB logging included potentially sensitive system information. |
CVE-2021-22024 | High | 7.5 | 2021-08-30 | The vRealize Operations Manager API (8.x prior to 8.5) contains an arbitrary log-file read vulnerability. An unauthenticated malicious actor with network acces… |
CVE-2021-39291 | High | 8.8 | 2021-08-23 | Certain NetModule devices allow credentials via GET parameters to CLI-PHP. These models with firmware before 4.3.0.113, 4.4.0.111, and 4.5.0.105 are affected… |
CVE-2021-37709 | Medium | 6.5 | 2021-08-16 | Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a vulnerability involving an insecure direct object reference of log files of… |
CVE-2021-36278 | High | 8.1 | 2021-08-16 | Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1.1 contain a sensitive information exposure vulnerability in log files. A local malicious user with… |
CVE-2021-21601 | High | 8.8 | 2021-08-10 | Dell EMC Data Protection Search, 19.4 and prior, and IDPA, 2.6.1 and prior, contain an Information Exposure in Log File Vulnerability in CIS. A local low privi… |
CVE-2021-21598 | Low | 3.9 | 2021-08-10 | Dell Wyse ThinOS, versions 9.0, 9.1, and 9.1 MR1, contain a Sensitive Information Disclosure Vulnerability. An authenticated attacker with physical access to t… |
CVE-2021-21597 | High | 7.2 | 2021-08-10 | Dell Wyse ThinOS, version 9.0, contains a Sensitive Information Disclosure Vulnerability. An authenticated malicious user with physical access to the system co… |
CVE-2021-26999 | Medium | 4.3 | 2021-08-06 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information when an Active Directory connection fails. The logged information is available only to a… |
CVE-2021-26998 | Medium | 4.3 | 2021-08-06 | NetApp Cloud Manager versions prior to 3.9.9 log sensitive information that is available only to authenticated users. Customers with auto-upgrade enabled shoul… |
CVE-2021-37760 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the audit log in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2021-37759 | Critical | 9.8 | 2021-07-31 | A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID). |
CVE-2021-21546 | High | 7.8 | 2021-07-29 | Dell EMC NetWorker versions 18.x,19.x prior to 19.3.0.4 and 19.4.0.0 contain an Information Disclosure in Log Files vulnerability. A local low-privileged user… |
CVE-2021-28131 | High | 7.5 | 2021-07-22 | Impala sessions use a 16 byte secret to verify that the session is not being hijacked by another user. However, these secrets appear in the Impala logs, theref… |
CVE-2020-21933 | High | 7.5 | 2021-07-21 | An issue was discovered in Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n where the admin password and private key could be found in the log tar packag… |
CVE-2020-23284 | High | 7.5 | 2021-07-20 | Information disclosure in aspx pages in MV's IDCE application v1.0 allows an attacker to copy and paste aspx pages in the end of the URL application that conne… |
CVE-2021-32767 | Medium | 5.3 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user cred… |
CVE-2021-34689 | Medium | 5.5 | 2021-07-15 | iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the system's Personal Key in world-readable %… |
CVE-2021-29759 | Low | 2.3 | 2021-07-07 | IBM App Connect Enterprise Certified Container 1.0, 1.1, 1.2, and 1.3 could allow a privileged user to obtain sensitive information from internal log files. IB… |
CVE-2020-24038 | Medium | 6.5 | 2021-07-07 | myFax version 229 logs sensitive information in the export log module which allows any user to access critical information. |
CVE-2021-35299 | High | 7.5 | 2021-06-28 | Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing. |
CVE-2021-0549 | Medium | 4.4 | 2021-06-22 | In sspRequestCallback of BondStateMachine.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local… |
CVE-2021-25423 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25422 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-25421 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password conn… |
CVE-2021-25420 | Medium | 5.5 | 2021-06-11 | Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password conne… |
CVE-2021-3039 | Low | 3.8 | 2021-06-10 | An information exposure through log file vulnerability exists in the Palo Alto Networks Prisma Cloud Compute Console where a secret used to authorize the role… |
CVE-2020-15380 | High | 7.5 | 2021-06-09 | Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level. |
CVE-2021-22219 | Medium | 4.4 | 2021-06-08 | All versions of GitLab CE/EE starting from 9.5 before 13.10.5, all versions starting from 13.11 before 13.11.5, and all versions starting from 13.12 before 13… |
CVE-2021-21558 | High | 8.2 | 2021-06-08 | Dell EMC NetWorker, 18.x, 19.1.x, 19.2.x 19.3.x, 19.4 and 19.4.0.1, contains an Information Disclosure vulnerability. A local administrator of the gstd system… |
CVE-2021-22516 | High | 7.5 | 2021-06-04 | Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability co… |
CVE-2021-3425 | Medium | 4.4 | 2021-06-01 | A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdb… |
CVE-2021-20191 | Medium | 5.5 | 2021-05-26 | A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those m… |
CVE-2021-20178 | Medium | 5.5 | 2021-05-26 | A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbu… |
CVE-2017-17675 | Medium | 5.3 | 2021-05-19 | BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system… |
CVE-2021-3528 | High | 8.8 | 2021-05-13 | A flaw was found in noobaa-operator in versions before 5.7.0, where internal RPC AuthTokens between the noobaa operator and the noobaa core are leaked into log… |
CVE-2021-32074 | High | 7.5 | 2021-05-07 | HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was n… |
CVE-2021-20536 | Medium | 6.2 | 2021-04-26 | IBM Spectrum Protect Plus File Systems Agent 10.1.6 and 10.1.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-… |
CVE-2021-26908 | Low | 3.3 | 2021-04-23 | Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert… |
CVE-2021-31546 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have… |
CVE-2021-3037 | Low | 2.3 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration… |
CVE-2021-3036 | Medium | 4.4 | 2021-04-20 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where secrets in PAN-OS XML API requests are logged in clea… |
CVE-2021-24024 | Medium | 4.3 | 2021-04-12 | A clear text storage of sensitive information into log file vulnerability in FortiADCManager 5.3.0 and below, 5.2.1 and below and FortiADC 5.3.7 and below may… |
CVE-2021-23924 | High | 7.5 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files. |
CVE-2021-3447 | Medium | 5.5 | 2021-04-01 | A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as wel… |
CVE-2021-22184 | Medium | 6.2 | 2021-03-26 | An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't pro… |
CVE-2021-25350 | Low | 2.0 | 2021-03-25 | Information Exposure vulnerability in Samsung Account prior to version 12.1.1.3 allows physically proximate attackers to access user information via log. |
CVE-2021-1442 | High | 7.8 | 2021-03-24 | A vulnerability in a diagnostic command for the Plug-and-Play (PnP) subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevate… |
CVE-2021-22310 | Medium | 4.4 | 2021-03-22 | There is an information leakage vulnerability in some huawei products. Due to the properly storage of specific information in the log file, the attacker can ob… |
CVE-2021-3167 | Medium | 6.5 | 2021-03-15 | In Cloudera Data Engineering (CDE) 1.3.0, JWT authentication tokens are exposed to administrators in virtual cluster server logs. |
CVE-2021-3034 | Medium | 5.1 | 2021-03-10 | An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integrati… |
CVE-2021-21361 | Medium | 5.3 | 2021-03-09 | The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables… |
CVE-2021-25284 | Medium | 4.4 | 2021-02-27 | An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level. |
CVE-2021-25688 | Medium | 5.5 | 2021-02-11 | Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts… |
CVE-2021-22133 | Low | 2.4 | 2021-02-10 | The Elastic APM agent for Go versions before 1.11.0 can leak sensitive HTTP header information when logging the details during an application panic. Normally… |
CVE-2020-7021 | Medium | 4.9 | 2021-02-10 | Elasticsearch versions before 7.10.0 and 6.8.14 have an information disclosure issue when audit logging and the emit_request_body option is enabled. The Elasti… |
CVE-2021-20359 | Medium | 6.5 | 2021-02-08 | IBM Cloud Pak for Automation 20.0.3, 20.0.2-IF002 - Business Automation Application Designer Component stores potentially sensitive information in log files th… |
CVE-2021-21722 | Medium | 4.4 | 2021-01-14 | A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulnerability to obtain… |
CVE-2021-1226 | Medium | 4.3 | 2021-01-13 | A vulnerability in the audit logging component of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco… |
CVE-2021-3032 | Medium | 4.4 | 2021-01-13 | An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where configuration secrets for the “http”, “email”, and “s… |
CVE-2020-26199 | Medium | 6.4 | 2021-01-05 | Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials (including the U… |
CVE-2020-0476 | Medium | 4.4 | 2020-12-15 | In onNotificationRemoved of Assistant.java, there is a possible leak of sensitive information to logs. This could lead to local information disclosure with Sys… |
CVE-2020-35234 | High | 7.5 | 2020-12-14 | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list th… |
CVE-2020-26416 | Medium | 4.0 | 2020-12-11 | Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=… |
CVE-2020-8566 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in… |
CVE-2020-8565 | Medium | 4.7 | 2020-12-07 | In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs… |
CVE-2020-8564 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file bei… |
CVE-2020-8563 | Medium | 4.7 | 2020-12-07 | In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud control… |
CVE-2020-6317 | Low | 3.5 | 2020-11-30 | In certain situations, an attacker with regular user credentials and local access to an ASE cockpit installation can access sensitive information which appears… |
CVE-2020-4900 | Medium | 5.5 | 2020-11-30 | IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991. |
CVE-2020-25640 | Medium | 5.3 | 2020-11-24 | A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensi… |
CVE-2020-10763 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heke… |
CVE-2020-10762 | Medium | 5.5 | 2020-11-24 | An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording… |
CVE-2020-4671 | Medium | 6.5 | 2020-11-16 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.2 and 5.2.0.0 through 5.2.6.5 stores potentially sensitive information in log files that cou… |
CVE-2020-2048 | Low | 3.3 | 2020-11-12 | An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed… |
CVE-2020-11646 | Medium | 4.3 | 2020-10-15 | A log information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticat… |
CVE-2020-11643 | Medium | 6.5 | 2020-10-15 | An information disclosure vulnerability in B&R GateManager 4260 and 9250 versions <9.0.20262 and GateManager 8250 versions <9.2.620236042 allows authenticated… |
CVE-2020-5389 | Medium | 6.5 | 2020-10-08 | Dell EMC OpenManage Integration for Microsoft System Center (OMIMSSC) for SCCM and SCVMM versions prior to 7.2.1 contain an information disclosure vulnerabilit… |
CVE-2020-26605 | High | 7.5 | 2020-10-06 | An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by… |
CVE-2020-25987 | High | 7.5 | 2020-10-06 | MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used… |
CVE-2020-9486 | High | 7.5 | 2020-10-01 | In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, t… |
CVE-2020-15370 | Medium | 6.5 | 2020-09-25 | Brocade Fabric OS versions before Brocade Fabric OS v7.4.2g could allow an authenticated, remote attacker to view a user password in cleartext. The vulnerabili… |
CVE-2020-14332 | Medium | 5.5 | 2020-09-11 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed… |
CVE-2020-14330 | Medium | 5.0 | 2020-09-11 | An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. Thi… |
CVE-2020-2044 | Low | 3.3 | 2020-09-09 | An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using… |