Insertion of Sensitive Information into Log File
CWE-532
The product writes sensitive information to a log file.
We track 193 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.8. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
Latest Insertion of Sensitive Information into Log File vulnerabilities
- 7.5 High severity
hoverfly: Insertion of Sensitive Information into Log File
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote att
- 7.8 High severity
PowerProtect Data Manager: Insertion of Sensitive Information into Log File
Dell PowerProtect Data Manager, Hyper-V, version(s) 19.19 and 19.20, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized
- 7.4 High severity
Promag 10 with HART: Insertion of Sensitive Information into Log File
A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining una
- 9.3 Critical severity
TTA: Exposure of Sensitive Information to an Unauthorized Actor
Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environmen
- 7.8 High severity
Control-M/Server: Insufficiently Protected Credentials
BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in to the database server. For example, when Control-M/Server on
- 9.3 Critical severity
PCL2-CE: Insertion of Sensitive Information into Log File
PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher. In PCL CE versions 2.12.0-beta.5 to 2.12.0-beta.9, the login credentials used during the third-party login process are accidentally recorded in the local log file. Although the log file is n
- 9.1 Critical severity
Brocade ASCG: Insertion of Sensitive Information into Log File
Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with security implications, such as unauthorized access, session hijacking, and information disclosure.
- 7.2 High severity
snyk: Insertion of Sensitive Information into Log File
Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs. Container Registry credentials provided via environment variables or command line arguments can be exposed when e
- 7.5 High severity
GitLab: Insertion of Sensitive Information into Log File
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
- 7.5 High severity
Apache IoTDB: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB. This issue affects Apache IoTDB: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users
- 7.5 High severity
Apache IoTDB JDBC driver: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver. This issue affects iotdb-jdbc: from 0.10.0 through 1.3.3, from 2.0.1-beta before 2.0.2. Users are recommende
- 7.6 High severity
iPadOS: Insertion of Sensitive Information into Log File
A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to access associated usernames and websites in a user's iCloud Keychain.
- 7.5 High severity
Checkmk: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators.
- 8.2 High severity
get-workflow-version-action: Insertion of Sensitive Information into Log File
canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the
- 7.6 High severity
kanidm-provision: Insertion of Sensitive Information into Log File
kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faulty function intrumentation in the (optional) kanidm patches provided by kandim-provision will cause the provisioned admin
- 4.6 Medium severity
Microsoft Windows NTFS Information Disclosure Exploited
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
- 7.5 High severity
Pie Register – User Registration, Profiles &…: Insertion of Sensitive Information into Log File
The Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.8.4 through
- 7.5 High severity
Checkmk: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be written to Apache error log file accessible to administrators.
- 7.5 High severity
HarmonyOS: Insertion of Sensitive Information into Log File
Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
- 7.5 High severity
MooWoodle: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in DualCube MooWoodle moowoodle allows Retrieve Embedded Sensitive Data.This issue affects MooWoodle: from n/a through <= 3.2.4.
- 9.4 Critical severity
FLXEON: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. Some information may be improperly disclosed through https access. This issue affects FLXEON through <= 9.3.4.
- 7.5 High severity
Safari: Insertion of Sensitive Information into Log File
A logging issue was addressed with improved data redaction. This issue is fixed in Safari 18.3, macOS Sequoia 15.3. A malicious app may be able to bypass browser extension authentication.
- 7.1 High severity
codeql-action: Insertion of Sensitive Information into Log File
In some circumstances, debug artifacts uploaded by the CodeQL Action after a failed code scanning workflow run may contain the environment variables from the workflow run, including any secrets that were exposed as environment variables to the workflow. Users
- 9.3 Critical severity
iTerm2: Insertion of Sensitive Information into Log File
iTerm2 3.5.6 through 3.5.10 before 3.5.11 sometimes allows remote attackers to obtain sensitive information from terminal commands by reading the /tmp/framer.txt file. This can occur for certain it2ssh and SSH Integration configurations, during remote logins t
- 7.8 High severity
XProtect VMS: Insertion of Sensitive Information into Log File
Disclosure of sensitive information in a Milestone XProtect Device Pack driver’s log file for third-party cameras, allows an attacker to read camera credentials stored in the Recording Server under specific conditions.
- 8.5 High severity
Command Centre Server: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File (CWE-532) in the Gallagher Command Centre Alarm Transmitter feature could allow an authenticated Operator to view some security sensitive information to which they have not been granted access. This issue affect
- 9.8 Critical severity
atlantis: Insertion of Sensitive Information into Log File
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlant
- 8.6 High severity
Cisco Nexus Dashboard Insights: Insertion of Sensitive Information into Log File
A vulnerability in a logging function of Cisco Nexus Dashboard Insights could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because remote controller credentials are recorded in an internal log th
- 8.6 High severity
Cisco Data Center Network Manager: Insertion of Sensitive Information into Log File
A vulnerability in a logging function of Cisco Nexus Dashboard Fabric Controller (NDFC) and Cisco Nexus Dashboard Orchestrator (NDO) could allow an attacker with access to a tech support file to view sensitive information. This vulnerability exists because HTT
- 7.5 High severity
ValeApp: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Oceanic Software ValeApp allows Query System for Information. This issue affects ValeApp: before v2.0.0.
- 7.5 High severity
terraform-provider-power-platform: Insertion of Sensitive Information into Log File
Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the s
- 7.5 High severity
Identity Manager REST Driver 1.1.2.0200: Insertion of Sensitive Information into Log File
Possible Insertion of Sensitive Information into Log File Vulnerability in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. This impact version before 1.1.2.0200.
- 7.5 High severity
Cisco Smart License Utility: Insertion of Sensitive Information into Log File
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a cr
- 8.2 High severity
OTRS: Insertion of Sensitive Information into Log File
Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled. This issue affects: * OTRS from 7.0.X
- 7.2 High severity
AI Engine: Insertion of Sensitive Information into Log File
AI Engine < 2.4.3 is susceptible to remote-code-execution (RCE) via Log Poisoning. The AI Engine WordPress plugin before 2.5.1 fails to validate the file extension of "logs_path", allowing Administrators to change log filetypes from .log to .php.
- 7.5 High severity
SmartMag: Missing Authorization
Insertion of Sensitive Information into Log File vulnerability in ThemeSphere SmartMag smartmag-responsive-retina-wordpress-magazine.This issue affects SmartMag: from n/a through < 10.1.0.
- 7.5 High severity
CTT Expresso para WooCommerce: Insertion of Sensitive Information into Log File
The CTT Expresso para WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 3.2.12 via the /wp-content/uploads/cepw directory. The generated .pdf and log files are publicly accessible and contain s
- 7.5 High severity
Apache Arrow Rust Object Store: Insertion of Sensitive Information into Log File
Exposure of temporary credentials in logs in Apache Arrow Rust Object Store (`object_store` crate), version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWi
- 9.3 Critical severity
Webscopes: Insertion of Sensitive Information into Log File
An information disclosure vulnerability in Phloc Webscopes 7.0.0 allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information.
- 7.5 High severity
WP 2FA: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WP 2FA allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP 2FA: from n/a through 2.6.3.