CWE-532— Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.— MITRE CWE catalog

1,390 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-532page 7 of 28

CVE-2021-35299HIGHCVSS 7.5EG 7.5
2021-06-28
Incorrect Access Control in Zammad 1.0.x up to 4.0.0 allows attackers to obtain sensitive information via email connection configuration probing.
CVE-2020-15380HIGHCVSS 7.5EG 7.5
2021-06-09
Brocade SANnav before version 2.1.1 logs account credentials at the ‘trace’ logging level.
CVE-2021-22516HIGHCVSS 7.5EG 7.5
2021-06-04
Insertion of Sensitive Information into Log File vulnerability in Micro Focus Secure API Manager (SAPIM) product, affecting version 2.0.0. The vulnerability could lead to sensitive information being in a log file.
CVE-2021-32074HIGHCVSS 7.5EG 7.5
2021-05-07
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
CVE-2021-23924HIGHCVSS 7.5EG 7.5
2021-04-01
An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.
CVE-2020-26605HIGHCVSS 7.5EG 7.5
2020-10-06
An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Exynos chipsets) software. They allow attackers to obtain sensitive information by reading a log. The Samsung ID is SVE-2020-18596 (October 2020).
CVE-2020-25987HIGHCVSS 7.5EG 7.5
2020-10-06
MonoCMS Blog 1.0 stores hard-coded admin hashes in the log.xml file in the source files for MonoCMS Blog. Hash type is bcrypt and hashcat mode 3200 can be used to crack the hash.
CVE-2020-9486HIGHCVSS 7.5EG 7.5
2020-10-01
In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensit…
CVE-2020-26106HIGHCVSS 7.5EG 7.5
2020-09-25
cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558).
CVE-2020-24566HIGHCVSS 7.5EG 7.5
2020-09-09
In Octopus Deploy 2020.3.x before 2020.3.4 and 2020.4.x before 2020.4.1, if an authenticated user creates a deployment or runbook process using Azure steps and sets the step's execution location to run on the server/worker, then (under cer…
CVE-2020-6938HIGHCVSS 7.5EG 7.5
2020-07-08
A sensitive information disclosure vulnerability in Tableau Server 10.5, 2018.x, 2019.x, 2020.x released before June 26, 2020, could allow access to sensitive information in log files.
CVE-2019-20852HIGHCVSS 7.5EG 7.5
2020-06-19
An issue was discovered in Mattermost Mobile Apps before 1.26.0. Local logging is not blocked for sensitive information (e.g., server addresses or message content).
CVE-2020-10752HIGHCVSS 7.5EG 7.5
2020-06-12
A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error t…
CVE-2020-13223HIGHCVSS 7.5EG 7.5
2020-06-10
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.
CVE-2020-13881HIGHCVSS 7.5EG 7.5
2020-06-06
In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.
CVE-2020-13830HIGHCVSS 7.5EG 7.5
2020-06-04
An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020).
CVE-2020-7654HIGHCVSS 7.5EG 7.5
2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.
CVE-2020-11968HIGHCVSS 7.5EG 7.5
2020-04-21
In the web-panel in IQrouter through 3.3.1, remote attackers can read system logs because of Incorrect Access Control. Note: The vendor claims that this vulnerability can only occur on a brand-new network that, after initiating the forced …
CVE-2020-11605HIGHCVSS 7.5EG 7.5
2020-04-08
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is sensitive information exposure from dumpstate in NFC logs. The Samsung ID is SVE-2019-16359 (April 2020).
CVE-2019-16528HIGHCVSS 7.5EG 7.5
2020-03-20
An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such as deleted/suppressed usernames and summaries, from AbuseLog revision data. Thi…
CVE-2020-1942HIGHCVSS 7.5EG 7.5
2020-02-11
In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flo…
CVE-2019-16204HIGHCVSS 7.5EG 7.5
2020-02-05
Brocade Fabric OS Versions before v7.4.2f, v8.2.2a, v8.1.2j and v8.2.1d could expose external passwords, common secrets or authentication keys used between the switch and an external server.
CVE-2019-16203HIGHCVSS 7.5EG 7.5
2020-02-05
Brocade Fabric OS Versions before v8.2.2a and v8.2.1d could expose the credentials of the remote ESRS server when these credentials are given as a command line option when configuring the ESRS client.
CVE-2019-18193HIGHCVSS 7.5EG 7.5
2020-02-03
In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0.114, key material inadvertently logged under certain conditions. Fixed included in 3.4.109, 4.0.027.13, 4.0.125 and 5.0.013.0.
CVE-2019-11290HIGHCVSS 7.5EG 7.5
2019-11-26
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
CVE-2012-1156HIGHCVSS 7.5EG 7.5
2019-11-14
Moodle before 2.2.2 has users' private files included in course backups
CVE-2013-1771HIGHCVSS 7.5EG 7.5
2019-11-07
The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.
CVE-2019-10084HIGHCVSS 7.5EG 7.5
2019-11-05
In Apache Impala 2.7.0 to 3.2.0, an authenticated user with access to the IDs of active Impala queries or sessions can interact with those sessions or queries via a specially-constructed request and thereby potentially bypass authorization…
CVE-2019-18385HIGHCVSS 7.5EG 7.5
2019-10-23
An issue was discovered on TerraMaster FS-210 4.0.19 devices. An unauthenticated attacker can download log files via the include/makecvs.php?Event= substring.
CVE-2019-6656HIGHCVSS 7.5EG 7.5
2019-09-25
BIG-IP APM Edge Client before version 7.1.8 (7180.2019.508.705) logs the full apm session ID in the log files. Vulnerable versions of the client are bundled with BIG-IP APM versions 15.0.0-15.0.1, 14,1.0-14.1.0.6, 14.0.0-14.0.0.4, 13.0.0-1…
CVE-2019-0202HIGHCVSS 7.5EG 7.5
2019-07-26
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not …
CVE-2019-13509HIGHCVSS 7.5EG 7.5
2019-07-18
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is r…
CVE-2019-11492HIGHCVSS 7.5EG 7.5
2019-04-26
ProjectSend before r1070 writes user passwords to the server logs.
CVE-2019-9734HIGHCVSS 7.5EG 7.5
2019-04-24
Aquarius CMS through 4.3.5 writes POST and GET parameters (including passwords) to a log file due to an overwriting of configuration parameters under certain circumstances.
CVE-2019-9724HIGHCVSS 7.5EG 7.5
2019-04-24
aquaverde Aquarius CMS through 4.3.5 allows Information Exposure through Log Files because of an error in the Log-File writer component.
CVE-2018-19513HIGHCVSS 7.5EG 7.5
2019-03-21
In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates explo…
CVE-2019-0741HIGHCVSS 7.5EG 7.5
2019-03-05
An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.
CVE-2019-0266HIGHCVSS 7.5EG 7.5
2019-02-15
Under certain conditions SAP HANA Extended Application Services, version 1.0, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Even though this trace file is protected from unauthori…
CVE-2018-19865HIGHCVSS 7.5EG 7.5
2018-12-05
A keystroke logging issue was discovered in Virtual Keyboard in Qt 5.7.x, 5.8.x, 5.9.x, 5.10.x, and 5.11.x before 5.11.3.
CVE-2018-14700HIGHCVSS 7.5EG 7.5
2018-12-03
Incorrect access control in the /mysql/api/logfile.php endpoint in Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to retrieve MySQL log files via the "name" URL parameter.
CVE-2018-17447HIGHCVSS 7.5EG 7.5
2018-10-23
An Information Exposure Through Log Files issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.
CVE-2018-3828HIGHCVSS 7.5EG 7.5
2018-09-19
Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers bein…
CVE-2018-7683HIGHCVSS 7.5EG 7.5
2018-06-21
Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files.
CVE-2018-12604HIGHCVSS 7.5EG 7.5
2018-06-20
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log.
CVE-2018-7204HIGHCVSS 7.5EG 7.5
2018-03-07
inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php con…
CVE-2018-7433HIGHCVSS 7.5EG 7.5
2018-03-02
The iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping for the logs page.
CVE-2017-15572HIGHCVSS 7.5EG 7.5
2017-10-18
In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information (password reset tokens) by reading a Referer log, because account/lost_password does not use a redirect.
CVE-2016-6799HIGHCVSS 7.5EG 7.5
2017-05-09
Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device.…
CVE-2016-9344HIGHCVSS 7.5EG 7.5
2017-02-13
An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.
CVE-2016-8346HIGHCVSS 7.5EG 7.5
2017-02-13
An issue was discovered in Moxa EDR-810 Industrial Secure Router. By accessing a specific uniform resource locator (URL) on the web server, a malicious user is able to access configuration and log files (PRIVILEGE ESCALATION).

Map vulnerabilities like CWE-532 to your infrastructure

EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →