CWE-532— Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.— MITRE CWE catalog

1,390 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-532page 17 of 28

CVE-2023-22869MEDIUMCVSS 5.5EG 5.5
2024-04-19
IBM Aspera Faspex 5.0.0 through 5.0.7 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 244119.
CVE-2024-25654MEDIUMCVSS 5.5EG 5.5
2024-03-18
Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensit…
CVE-2024-1141MEDIUMCVSS 5.5EG 5.5
2024-02-01
A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.
CVE-2024-23840MEDIUMCVSS 5.5EG 5.5
2024-01-30
GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerabil…
CVE-2023-42937MEDIUMCVSS 5.5EG 5.5
2024-01-23
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2 and iPadOS 17.2…
CVE-2023-6460MEDIUMCVSS 5.5EG 5.5
2023-12-04
A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read ac…
CVE-2023-6287MEDIUMCVSS 5.5EG 5.5
2023-11-27
Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files.
CVE-2023-32283MEDIUMCVSS 5.5EG 5.5
2023-11-14
Insertion of sensitive information into log file in some Intel(R) On Demand software before versions 1.16.2, 2.1.1, 3.1.0 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2023-41254MEDIUMCVSS 5.5EG 5.5
2023-10-25
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Ventura 13.6.1, macOS Sonoma 14.1. An app may be able to…
CVE-2023-45825MEDIUMCVSS 5.5EG 5.5
2023-10-19
ydb-go-sdk is a pure Go native and database/sql driver for the YDB platform. Since ydb-go-sdk v3.48.6 if you use a custom credentials object (implementation of interface Credentials it may leak into logs. This happens because this object c…
CVE-2023-5339MEDIUMCVSS 5.5EG 5.5
2023-10-17
Mattermost Desktop fails to set an appropriate log level during initial run after fresh installation resulting in logging all keystrokes including password entry being logged.
CVE-2023-25604MEDIUMCVSS 5.5EG 5.5
2023-10-10
An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext passwords in the RADIUS logs.
CVE-2023-43485MEDIUMCVSS 5.5EG 5.5
2023-10-10
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2023-41253MEDIUMCVSS 5.5EG 5.5
2023-10-10
When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2023-5182MEDIUMCVSS 5.5EG 5.5
2023-10-07
Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could use this information to find hashed passwords and possibly escalate their privilege.
CVE-2023-45241MEDIUMCVSS 5.5EG 5.5
2023-10-05
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 37391.
CVE-2023-22644MEDIUMCVSS 5.5EG 5.5
2023-09-20
A user can reverse engineer the JWT token (JSON Web Token) used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE.
CVE-2023-4688MEDIUMCVSS 5.5EG 5.5
2023-08-31
Sensitive information leak through log files. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35433.
CVE-2023-32455MEDIUMCVSS 5.5EG 5.5
2023-07-20
Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information …
CVE-2023-32447MEDIUMCVSS 5.5EG 5.5
2023-07-20
Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. A malicious user with local access to the device could exploit this vulnerability to read sensitive information written to the lo…
CVE-2023-32446MEDIUMCVSS 5.5EG 5.5
2023-07-20
Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. An unauthenticated malicious user with local access to the device could exploit this vulnerability to read sensitive information …
CVE-2023-32392MEDIUMCVSS 5.5EG 5.5
2023-06-23
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, macOS Big Sur 11.7.7, macOS Monterey 12.6.6, iOS 16.5 and iPadOS 16.5. An app may be abl…
CVE-2023-29471MEDIUMCVSS 5.5EG 5.5
2023-04-27
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
CVE-2023-1786MEDIUMCVSS 5.5EG 5.5
2023-04-26
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
CVE-2022-2084MEDIUMCVSS 5.5EG 5.5
2023-04-19
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
CVE-2021-3429MEDIUMCVSS 5.5EG 5.5
2023-04-19
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another u…
CVE-2023-30610MEDIUMCVSS 5.5EG 5.5
2023-04-19
aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key…
CVE-2022-48228MEDIUMCVSS 5.5EG 5.5
2023-04-04
An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka CORE-7362.
CVE-2023-1550MEDIUMCVSS 5.5EG 5.5
2023-03-29
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gai…
CVE-2021-3684MEDIUMCVSS 5.5EG 5.5
2023-03-24
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull se…
CVE-2023-20859MEDIUMCVSS 5.5EG 5.5
2023-03-23
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
CVE-2023-21435MEDIUMCVSS 5.5EG 5.5
2023-02-09
Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log.
CVE-2022-20458MEDIUMCVSS 5.5EG 5.5
2023-01-26
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prin…
CVE-2022-33187MEDIUMCVSS 5.5EG 5.5
2022-12-09
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
CVE-2022-44745MEDIUMCVSS 5.5EG 5.5
2022-11-07
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
CVE-2022-28625MEDIUMCVSS 5.5EG 5.5
2022-08-31
A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a co…
CVE-2022-20278MEDIUMCVSS 5.5EG 5.5
2022-08-12
In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede…
CVE-2022-20651MEDIUMCVSS 5.5EG 5.5
2022-06-22
A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shar…
CVE-2022-30148MEDIUMCVSS 5.5EG 5.5
2022-06-15
Windows Desired State Configuration (DSC) Information Disclosure Vulnerability
CVE-2022-28774MEDIUMCVSS 5.5EG 5.5
2022-05-11
Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
CVE-2022-28161MEDIUMCVSS 5.5EG 5.5
2022-05-09
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode…
CVE-2022-27636MEDIUMCVSS 5.5EG 5.5
2022-05-05
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions…
CVE-2022-29810MEDIUMCVSS 5.5EG 5.5
2022-04-27
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
CVE-2022-27888MEDIUMCVSS 5.5EG 5.5
2022-04-26
Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.
CVE-2021-20180MEDIUMCVSS 5.5EG 5.5
2022-03-16
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_p…
CVE-2022-27195MEDIUMCVSS 5.5EG 5.5
2022-03-15
Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are s…
CVE-2022-22703MEDIUMCVSS 5.5EG 5.5
2022-01-17
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.
CVE-2021-44234MEDIUMCVSS 5.5EG 5.5
2022-01-14
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CVE-2021-39032MEDIUMCVSS 5.5EG 5.5
2022-01-14
IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 213962.
CVE-2021-45449MEDIUMCVSS 5.5EG 5.5
2022-01-12
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged i…

Map vulnerabilities like CWE-532 to your infrastructure

EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →