Insertion of Sensitive Information Into Debugging Code
CWE-215
The product inserts sensitive information into debugging code.
We track 10 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3.
How this weakness is prevented
- Implementation: Do not leave debug statements that could be executed in the source code. Ensure that all debug information is eradicated before releasing the software.
- Architecture and Design: Compartmentalize the system to have safe areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Latest Insertion of Sensitive Information Into Debugging Code vulnerabilities
- 8.2 High severity
Trident: Insertion of Sensitive Information Into Debugging Code
Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials.
- 9.3 Critical severity
Cadmos LTI: Insertion of Sensitive Information Into Debugging Code
The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel
- 9.3 Critical severity
siyuan: Insertion of Sensitive Information Into Debugging Code
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets inc
- 7.0 High severity
Rancher: Insertion of Sensitive Information Into Debugging Code
A information disclosure when DEBUG loglevel is set in SUSE Rancher AI Agent 1.0 before 1.0.2 could leak API keys or LLM response text with potential sensitive data into logfiles, allowing local attackers to misuse respective gained data or credentials.
- 9.4 Critical severity
dgraph: Insufficiently Protected Credentials
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, expos
- 7.5 High severity
METIS WIC: Insertion of Sensitive Information Into Debugging Code
The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mod
- 7.5 High severity
CONPROSYS HMI System (CHS): Insertion of Sensitive Information Into Debugging Code
The Contec Co.,Ltd. CONPROSYS HMI System (CHS) exposes a PHP phpinfo() debug page to unauthenticated users that may contain sensitive data useful for an attacker.This issue affects CONPROSYS HMI System (CHS): before 3.7.7.
- 7.5 High severity
Vasion Print: Insertion of Sensitive Information Into Debugging Code
Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data V-2022-003.
- 9.8 Critical severity
ITSM: Insertion of Sensitive Information Into Debugging Code
An information disclosure vulnerability in Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier allows an unauthenticated attacker to obtain the OIDC client secret via debug information.
- 7.5 High severity
journalpump: Cleartext Transmission of Sensitive Information
journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including