CWE-532— Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.— MITRE CWE catalog

1,390 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-532page 20 of 28

CVE-2024-42349MEDIUMCVSS 5.3EG 5.3
2024-08-02
FOG is a cloning/imaging/rescue suite/inventory management system. FOG Server 1.5.10.41.4 and earlier can leak authorized and rejected logins via logs stored directly on the root of the web server. FOG Server creates 2 logs on the root of …
CVE-2024-6687MEDIUMCVSS 5.3EG 5.3
2024-08-01
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly acc…
CVE-2024-40636MEDIUMCVSS 5.3EG 5.3
2024-07-17
Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applications using externalized configuration, service discovery, distributed tracing, application management, …
CVE-2024-37270MEDIUMCVSS 5.3EG 5.3
2024-07-10
Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
CVE-2024-37205MEDIUMCVSS 5.3EG 5.3
2024-07-10
Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4.
CVE-2024-22276MEDIUMCVSS 5.3EG 5.3
2024-06-27
VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability. A malicious actor with adjacent access to web/proxy server logging may be able to obtain sensitive information from URLs that …
CVE-2022-44587MEDIUMCVSS 5.3EG 5.3
2024-06-21
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.
CVE-2024-32811MEDIUMCVSS 5.3EG 5.3
2024-06-09
Insertion of Sensitive Information into Log File vulnerability in Octolize USPS Shipping for WooCommerce – Live Rates.This issue affects USPS Shipping for WooCommerce – Live Rates: from n/a through 1.9.4.
CVE-2024-34798MEDIUMCVSS 5.3EG 5.3
2024-06-03
Insertion of Sensitive Information into Log File vulnerability in Lukman Nakib Debug Log – Manger Tool.This issue affects Debug Log – Manger Tool: from n/a through 1.4.5.
CVE-2024-34550MEDIUMCVSS 5.3EG 5.3
2024-05-14
Insertion of Sensitive Information into Log File vulnerability in AlexaCRM Dynamics 365 Integration.This issue affects Dynamics 365 Integration: from n/a through 1.3.17.
CVE-2024-33922MEDIUMCVSS 5.3EG 5.3
2024-05-02
Insertion of Sensitive Information into Log File vulnerability in Jordy Meow WP Media Cleaner.This issue affects WP Media Cleaner: from n/a through 6.7.2.
CVE-2024-32788MEDIUMCVSS 5.3EG 5.3
2024-04-24
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Joomla to WordPress.This issue affects FG Joomla to WordPress: from n/a through 4.20.2.
CVE-2024-32686MEDIUMCVSS 5.3EG 5.3
2024-04-18
Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.
CVE-2024-32513MEDIUMCVSS 5.3EG 5.3
2024-04-17
Insertion of Sensitive Information into Log File vulnerability in AdTribes.Io Product Feed PRO for WooCommerce.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.3.1.
CVE-2024-31353MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVE-2024-31298MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
CVE-2024-31247MEDIUMCVSS 5.3EG 5.3
2024-04-10
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.
CVE-2024-2302MEDIUMCVSS 5.3EG 5.3
2024-04-09
The Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.9. This makes it possib…
CVE-2024-30523MEDIUMCVSS 5.3EG 5.3
2024-03-31
Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Mailchimp Add On pmpro-mailchimp.This issue affects Paid Memberships Pro – Mailchimp Add On: from n/a through 2.3.4.
CVE-2024-30514MEDIUMCVSS 5.3EG 5.3
2024-03-29
Insertion of Sensitive Information into Log File vulnerability in Paid Memberships Pro Paid Memberships Pro – Payfast Gateway Add On.This issue affects Paid Memberships Pro – Payfast Gateway Add On: from n/a through 1.4.1.
CVE-2024-30511MEDIUMCVSS 5.3EG 5.3
2024-03-29
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG PrestaShop to WooCommerce.This issue affects FG PrestaShop to WooCommerce: from n/a through 4.45.1.
CVE-2024-25923MEDIUMCVSS 5.3EG 5.3
2024-03-28
Insertion of Sensitive Information into Log File vulnerability in PeepSo Community by PeepSo.This issue affects Community by PeepSo: from n/a through 6.2.7.0.
CVE-2024-22138MEDIUMCVSS 5.3EG 5.3
2024-03-28
Insertion of Sensitive Information into Log File vulnerability in Seraphinite Solutions Seraphinite Accelerator.This issue affects Seraphinite Accelerator: from n/a through 2.20.47.
CVE-2023-50740MEDIUMCVSS 5.3EG 5.3
2024-03-06
In Apache Linkis <=1.4.0, The password is printed to the log when using the Oracle data source of the Linkis data source module. We recommend users upgrade the version of Linkis to version 1.5.0
CVE-2024-23686MEDIUMCVSS 5.3EG 5.3
2024-01-19
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
CVE-2023-52146MEDIUMCVSS 5.3EG 5.3
2024-01-05
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Aaron J 404 Solution.This issue affects 404 Solution: from n/a through 2.33.0.
CVE-2023-41934MEDIUMCVSS 5.3EG 5.3
2023-09-06
Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of credentials specified in custom Maven settings in Pipeline build logs if "Treat username as secret"…
CVE-2023-26026MEDIUMCVSS 5.3EG 5.3
2023-07-19
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
CVE-2022-43887MEDIUMCVSS 5.3EG 5.3
2022-12-19
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.…
CVE-2022-23716MEDIUMCVSS 5.3EG 5.3
2022-09-28
A flaw was discovered in ECE before 3.1.1 that could lead to the disclosure of the SAML signing private key used for the RBAC features, in deployment logs in the Logging and Monitoring cluster.
CVE-2022-32217MEDIUMCVSS 5.3EG 5.3
2022-09-23
A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs.
CVE-2022-33911MEDIUMCVSS 5.3EG 5.3
2022-07-12
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
CVE-2022-31047MEDIUMCVSS 5.3EG 5.3
2022-06-14
TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception h…
CVE-2022-29869MEDIUMCVSS 5.3EG 5.3
2022-04-28
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
CVE-2021-38939MEDIUMCVSS 5.3EG 5.3
2022-04-27
IBM QRadar SIEM 7.3, 7.4, and 7.5 stores potentially sensitive information in log files that could be read by an user with access to creating domains. IBM X-Force ID: 211037.
CVE-2022-24875MEDIUMCVSS 5.3EG 5.3
2022-04-21
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` a…
CVE-2022-26907MEDIUMCVSS 5.3EG 5.3
2022-04-15
Azure SDK for .NET Information Disclosure Vulnerability
CVE-2021-25009MEDIUMCVSS 5.3EG 5.3
2022-03-07
The CorreosExpress WordPress plugin through 2.6.0 generates log files which are publicly accessible, and contain sensitive information such as sender/receiver names, phone numbers, physical and email addresses
CVE-2021-32767MEDIUMCVSS 5.3EG 5.3
2021-07-20
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log lev…
CVE-2017-17675MEDIUMCVSS 5.3EG 5.3
2021-05-19
BMC Remedy Mid Tier 9.1SP3 is affected by log hijacking. Remote logging can be accessed by unauthenticated users, allowing for an attacker to hijack the system logs. This data can include user names and HTTP data.
CVE-2020-25640MEDIUMCVSS 5.3EG 5.3
2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.
CVE-2020-14518MEDIUMCVSS 5.3EG 5.3
2020-08-21
Philips DreamMapper, Version 2.24 and prior. Information written to log files can give guidance to a potential attacker.
CVE-2020-15829MEDIUMCVSS 5.3EG 5.3
2020-08-08
In JetBrains TeamCity before 2019.2.3, password parameters could be disclosed via build logs.
CVE-2020-15581MEDIUMCVSS 5.3EG 5.3
2020-07-07
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The kernel logging feature allows attackers to discover virtual addresses via vectors involving shared memory. The Samsung ID is SVE-2020-17605 (J…
CVE-2020-1928MEDIUMCVSS 5.3EG 5.3
2020-01-28
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was …
CVE-2019-3429MEDIUMCVSS 5.3EG 5.3
2019-12-23
All versions up to V4.01.01.02 of ZTE ZXCLOUD GoldenData VAP product have a file reading vulnerability. Attackers could obtain log file information without authorization, causing the disclosure of sensitive information.
CVE-2019-3649MEDIUMCVSS 5.3EG 5.3
2019-11-13
Information Disclosure vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attackers to gain access to hashed credentials via carefully constructed POST request extracting incorrectly recorded dat…
CVE-2019-11465MEDIUMCVSS 5.3EG 5.3
2019-09-10
An issue was discovered in Couchbase Server 5.5.x through 5.5.3 and 6.0.0. The Memcached "connections" stat block command emits a non-redacted username. The system information submitted to Couchbase as part of a bug report included the use…
CVE-2018-3776MEDIUMCVSS 5.3EG 5.3
2018-08-12
Improper input validator in Nextcloud Server prior to 12.0.3 and 11.0.5 could lead to an attacker's actions not being logged in the audit log.
CVE-2018-8719MEDIUMCVSS 5.3EG 5.3
2018-04-04
An issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp-content/uploads/wp-security-audit-log/* files is not restricted. For example, these files are indexed by Google and allows for attackers to possi…

Map vulnerabilities like CWE-532 to your infrastructure

EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →