Insertion of Sensitive Information into Log File
CWE-532
The product writes sensitive information to a log file.
We track 193 vulnerabilities of this type. 99% are rated high or critical, and the average CVSS score is 7.8. 2 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design Implementation: Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- Distribution: Remove debug log files before deploying the application into production.
- Operation: Protect log files against unauthorized read/write.
- Implementation: Adjust configurations appropriately when software is transitioned from a debug state to production.
Latest Insertion of Sensitive Information into Log File vulnerabilities
- 7.5 High severity
Trend Micro Moibile Security for Enterprise: Insertion of Sensitive Information into Log File
A remote attacker could leverage a vulnerability in Trend Micro Mobile Security (Enterprise) 9.8 SP5 to download a particular log file which may contain sensitive information regarding the product.
- 8.8 High severity
hoppscotch: Insertion of Sensitive Information into Log File
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with ful
- 7.5 High severity
Jenkins HashiCorp Vault Plugin: Insertion of Sensitive Information into Log File
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
- 4.4 Medium severity
Samsung Mobile Devices Insertion of Sensitive Information Into Log File Exploited
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
- 7.5 High severity
smartcars-3-bugs: Insertion of Sensitive Information into Log File
smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensur
- 7.5 High severity
Db2 for Linux, UNIX and Windows: Insertion of Sensitive Information into Log File
IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IBM X-Force ID: 241677.
- 7.5 High severity
SUSHIRO App for Android: Insertion of Sensitive Information into Log File
SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information from the log file. Affected products/versions are as follows: SUSHIRO Ver.4.0.31, Thailand SUSHIRO Ver.1.0.0, Hong Kong SU
- 7.5 High severity
tinacms: Exposure of Sensitive Information to an Unauthorized Actor
Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext t
- 7.5 High severity
syft: Insertion of Sensitive Information into Log File
syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. A password disclosure flaw was found in Syft versions v0.69.0 and v0.69.1. This flaw leaks the password stored in the SYFT_ATTEST_PASS
- 8.8 High severity
PowerScale OneFS: Insertion of Sensitive Information into Log File
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. A low privileges user could potentially exploit this vulnerability, leading to information disclosure and escalation of privileges.
- 8.1 High severity
PowerScale OneFS: Insertion of Sensitive Information into Log File
Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI module. A low-privileged user with permission to read logs on the cluster could potentially exploit this vulnerability, le
- 7.8 High severity
PowerScale OneFS: Insertion of Sensitive Information into Log File
Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. A low privilege local attacker could potentially exploit this vulnerability, leading to system takeover.
- 7.5 High severity
spinnaker: Insertion of Sensitive Information into Log File
Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via pa
- 7.5 High severity
M-Files Server: Insertion of Sensitive Information into Log File
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
- 7.5 High severity
Octopus Server: Insertion of Sensitive Information into Log File
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled.
- 7.5 High severity
Foundry Build2: Insertion of Sensitive Information into Log File
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
- 7.5 High severity
Foundry Code-Workbooks: Insertion of Sensitive Information into Log File
Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log records of any Python code being run. These service logs included the Foundry token that represents the
- 7.5 High severity
1350 Optical Management System: Insertion of Sensitive Information into Log File
In NOKIA 1350 OMS R14.2, an Insertion of Sensitive Information into an Application Log File vulnerability occurs. The web application stores critical information, such as cleartext user credentials, in world-readable files in the filesystem.
- 7.5 High severity
PowerScale OneFS: Insertion of Sensitive Information into Log File
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3 , contain an insertion of sensitive information in log files vulnerability. A remote unprivileged attacker could potentially exploit this vulnerability, leading
- 7.5 High severity
Consul Template: Insertion of Sensitive Information into Log File
HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29
- 7.5 High severity
Wl-wn579x3 Firmware: Direct Request
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
- 7.5 High severity
ZXMP M721: Insertion of Sensitive Information into Log File
ZXMP M721 has an information leak vulnerability. Since the serial port authentication on the ZBOOT interface is not effective although it is enabled, an attacker could use this vulnerability to log in to the device to obtain sensitive information.
- 7.5 High severity
OpenVPN Access Server: Insertion of Sensitive Information into Log File
The OpenVPN Access Server installer creates a log file readable for everyone, which from version 2.10.0 and before 2.11.0 may contain a random generated admin password
- 7.5 High severity
weave-gitops: Insertion of Sensitive Information into Log File
Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster c
- 7.5 High severity
SINEMA Remote Connect Server: Insertion of Sensitive Information into Log File
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). A customized HTTP POST request could force the application to write the status of a given user to a log file, exposing sensitive user information that could provide valu
- 7.1 High severity
Cisco TelePresence Video Communication Server…: Insertion of Sensitive Information into Log File
Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker to write files or disclose sensitive information on an affe
- 7.5 High severity
cve-services: Insertion of Sensitive Information into Log File
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be availabl
- 7.5 High severity
notebook: Insertion of Sensitive Information into Log File
The Jupyter notebook is a web-based notebook environment for interactive computing. Prior to version 6.4.9, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth cookie and other header values are rec
- 7.5 High severity
Dvs Avilys: Insertion of Sensitive Information into Log File
The Reporting module in Aseco Lietuva document management system DVS Avilys before 3.5.58 allows unauthorized file download. An unauthenticated attacker can impersonate an administrator by reading administrative files.
- 7.5 High severity
jupyter_server: Insertion of Sensitive Information into Log File
The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications. Prior to version 1.15.4, unauthorized actors can access sensitive information from server logs. Anytime a 5xx error is triggered, the auth
- 7.8 High severity
Sophos UTM: Insertion of Sensitive Information into Log File
Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
- 7.5 High severity
keepass: Insertion of Sensitive Information into Log File
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
- 7.5 High severity
Terraform Enterprise: Insertion of Sensitive Information into Log File
HashiCorp Terraform Enterprise v202112-1, v202112-2, v202201-1, and v202201-2 were configured to log inbound HTTP requests in a manner that may capture sensitive data. Fixed in v202202-1.