Insertion of Sensitive Information into Log File
CWE-532
The product writes sensitive information to a log file.
We track 193 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.8. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
Latest Insertion of Sensitive Information into Log File vulnerabilities
- 7.5 High severity
GlobalProtect App: Insertion of Sensitive Information into Log File
A problem with the Palo Alto Networks GlobalProtect app can result in exposure of encrypted user credentials, used for connecting to GlobalProtect, in application logs. Normally, these application logs are only viewable by local users and are included when gen
- 7.5 High severity
Easy Forms for Mailchimp: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Code Parrots Easy Forms for Mailchimp.This issue affects Easy Forms for Mailchimp: from n/a through 6.9.0.
- 7.5 High severity
apko: Insufficiently Protected Credentials
apko is an apk-based OCI image builder. apko exposures HTTP basic auth credentials from repository and keyring URLs in log output. This vulnerability is fixed in v0.14.5.
- 9.8 Critical severity
valtimo-frontend-libraries: Insertion of Sensitive Information into Log File
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this to
- 7.5 High severity
Solid Affiliate: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1.
- 8.6 High severity
Brocade SANnav: Insertion of Sensitive Information into Log File
A vulnerability in Brocade SANnav before v2.3.1 and v2.3.0a prints Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node's support save.
- 7.5 High severity
Brocade SANnav: Insertion of Sensitive Information into Log File
When Brocade SANnav before v2.3.1 and v2.3.0a servers are configured in Disaster Recovery mode, the encryption key is stored in the DR log files. This could provide attackers with an additional, less-protected path to acquiring the encryption key.
- 7.5 High severity
User Spam Remover: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
- 7.5 High severity
WordPress Backup & Migration: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WebToffee WordPress Backup & Migration.This issue affects WordPress Backup & Migration: from n/a through 1.4.7.
- 7.5 High severity
Subscribe To Comments Reloaded: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725.
- 7.5 High severity
FG Drupal to WordPress: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Frédéric GILLES FG Drupal to WordPress.This issue affects FG Drupal to WordPress: from n/a through 3.70.3.
- 7.2 High severity
Splunk Enterprise: Insertion of Sensitive Information into Log File
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the software potentially exposes authentication tokens during the token validation process. This exposure happens when either Splunk Enterprise runs in debug mode or the JsonWebToken component has be
- 7.5 High severity
CF7 Google Sheets Connector: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in GSheetConnector CF7 Google Sheets Connector.This issue affects CF7 Google Sheets Connector: from n/a through 5.0.5.
- 9.9 Critical severity
Hitachi Virtual Storage Platform: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual Storage Platform G1000, G1500, Hitachi Virtual Storage Platform F1500, Hitachi Virtual Storage Platform
- 7.1 High severity
Dualsafe Password Manager: Insertion of Sensitive Information into Log File
An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked credentials as plaintext in a log file that can be accessed by the local user without knowledge of the master secret.
- 7.1 High severity
freescout: Insertion of Sensitive Information into Log File
FreeScout is an open source help desk and shared inbox built with PHP. A vulnerability has been identified in the Free Scout Application, which exposes SMTP server credentials used by an organization in the application to users of the application. This issue a
- 7.5 High severity
APM Server: Insertion of Sensitive Information into Log File
An issue was discovered whereby APM Server could log at ERROR level, a response from Elasticsearch indicating that indexing the document failed and that response would contain parts of the original document. Depending on the nature of the document that the APM
- 7.2 High severity
Splunk Add-on Builder: Insertion of Sensitive Information into Log File
In Splunk Add-on Builder versions below 4.1.4, the application writes user session tokens to its internal log files when you visit the Splunk Add-on Builder or when you build or edit a custom app or add-on.
- 7.5 High severity
OTRS: Insertion of Sensitive Information into Log File
Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects OTRS: from 7.0.X through 7.0.48, from 8.0.X through 8.0.37, from 2023.X through 2023.1.1.
- 7.5 High severity
Dormitory Management System: Exposure of Sensitive Information to an Unauthorized Actor
A vulnerability was found in code-projects Dormitory Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file modifyuser.php. The manipulation of the argument mname leads to information disclosure. The exp
- 7.5 High severity
Database Cleaner: Clean, Optimize & Repair: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Database Cleaner: Clean, Optimize & Repair.This issue affects Database Cleaner: Clean, Optimize & Repair: from n/a through 0.9.8.
- 7.5 High severity
Defender Security – Malware Scanner, Login…: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security – Malware Scanner, Login Security & Firewall.This issue affects Defender Security – Malware Scanner, Login Security & Firewall: from n/a through 4.1.0.
- 7.5 High severity
WP Optin Wheel – Gamified Optin Email…: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StudioWombat WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress and WooCommerce.This issue affects WP Optin Wheel – Gamified Optin Email Marketing Tool for WordPress an
- 7.5 High severity
WP Stripe Checkout: Insertion of Sensitive Information into Log File
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Naa986 WP Stripe Checkout.This issue affects WP Stripe Checkout: from n/a through 1.2.2.37.
- 7.5 High severity
PayHere Payment Gateway: Insertion of Sensitive Information into Log File
The PayHere Payment Gateway WordPress plugin before 2.2.12 automatically creates publicly-accessible log files containing sensitive information when transactions occur.
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server.
- 9.1 Critical severity
Cryptospike: Insertion of Sensitive Information into Log File
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to impersonate other users in web management and the REST API by reading JWT tokens from logs (as a Granafa authenticated use
- 9.8 Critical severity
Pandora FMS: Insertion of Sensitive Information into Log File
Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory for cron log backups. The contents of these log files can then be abused to authenticate to the appl
- 7.5 High severity
MongoDB Atlas Kubernetes Operator: Insertion of Sensitive Information into Log File
The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6.
- 7.5 High severity
Apache Airflow Celery provider: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the
- 7.5 High severity
Kibana: Insertion of Sensitive Information into Log File
An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only Kibana version 8.10.0 when logging in the JSON layout or when the pattern layout is configured to log the %meta pattern
- 8.1 High severity
Fleet Server: Insertion of Sensitive Information into Log File
An issue was discovered in Fleet Server >= v8.10.0 and < v8.10.3 where Agent enrolment tokens are being inserted into the Fleet Server’s log file in plain text. These enrolment tokens could allow someone to enrol an agent into an agent policy, and potentially
- 9.1 Critical severity
Endpoint: Insertion of Sensitive Information into Log File
If Elastic Endpoint (v7.9.0 - v8.10.3) is configured to use a non-default option in which the logging level is explicitly set to debug, and when Elastic Agent is simultaneously configured to collect and send those logs to Elasticsearch, then Elastic Agent API
- 7.5 High severity
Shenzhen Reachfar v28: Insertion of Sensitive Information into Log File
Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networ
- 7.5 High severity
IBERMATICA RPS 2019: Insertion of Sensitive Information into Log File
A Cryptographic Issue vulnerability has been found on IBERMATICA RPS, affecting version 2019. By firstly downloading the log file, an attacker could retrieve the SQL query sent to the application in plaint text. This log file contains the password hashes coded
- 7.5 High severity
IBERMATICA RPS 2019: Insertion of Sensitive Information into Log File
Information exposure vulnerability in IBERMATICA RPS 2019, which exploitation could allow an unauthenticated user to retrieve sensitive information, such as usernames, IP addresses or SQL queries sent to the application. By accessing the URL /RPS2019Service/st
- 9.6 Critical severity
argo-cd: Insertion of Sensitive Information into Log File
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. pu
- 7.5 High severity
GitLab: Insertion of Sensitive Information into Log File
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a speci
- 7.5 High severity
Planning Analytics Cartridge for Cloud Pak for…: Insertion of Sensitive Information into Log File
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
- 7.5 High severity
Sterling Connect:Express for UNIX: Insertion of Sensitive Information into Log File
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.