CWE-532— Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.— MITRE CWE catalog
1,353 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-532page 17 of 28
- CVE-2022-2084MEDIUMCVSS 5.5EG 5.52023-04-19
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
- CVE-2021-3429MEDIUMCVSS 5.5EG 5.52023-04-19
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another u…
- CVE-2023-30610MEDIUMCVSS 5.5EG 5.52023-04-19
aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key…
- CVE-2022-48228MEDIUMCVSS 5.5EG 5.52023-04-04
An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka CORE-7362.
- CVE-2023-1550MEDIUMCVSS 5.5EG 5.52023-03-29
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gai…
- CVE-2021-3684MEDIUMCVSS 5.5EG 5.52023-03-24
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull se…
- CVE-2023-20859MEDIUMCVSS 5.5EG 5.52023-03-23
In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
- CVE-2023-21435MEDIUMCVSS 5.5EG 5.52023-02-09
Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory address information via log.
- CVE-2022-20458MEDIUMCVSS 5.5EG 5.52023-01-26
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prin…
- CVE-2022-33187MEDIUMCVSS 5.5EG 5.52022-12-09
Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
- CVE-2022-44745MEDIUMCVSS 5.5EG 5.52022-11-07
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
- CVE-2022-28625MEDIUMCVSS 5.5EG 5.52022-08-31
A local disclosure of sensitive information vulnerability was discovered in HPE OneView version(s): Prior to 7.0 or 6.60.01. A low privileged user could locally exploit this vulnerability to disclose sensitive information resulting in a co…
- CVE-2022-20278MEDIUMCVSS 5.5EG 5.52022-08-12
In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information disclosure with System execution privileges needed. User interaction is not neede…
- CVE-2022-20651MEDIUMCVSS 5.5EG 5.52022-06-22
A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive information in clear text on an affected system. Cisco ADSM must be deployed in a shar…
- CVE-2022-30148MEDIUMCVSS 5.5EG 5.52022-06-15
Windows Desired State Configuration (DSC) Information Disclosure Vulnerability
- CVE-2022-28774MEDIUMCVSS 5.5EG 5.52022-05-11
Under certain conditions, the SAP Host Agent logfile shows information which would otherwise be restricted.
- CVE-2022-28161MEDIUMCVSS 5.5EG 5.52022-05-09
An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode…
- CVE-2022-27636MEDIUMCVSS 5.5EG 5.52022-05-05
On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions…
- CVE-2022-29810MEDIUMCVSS 5.5EG 5.52022-04-27
The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
- CVE-2022-27888MEDIUMCVSS 5.5EG 5.52022-04-26
Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fixed in 2.249.1.
- CVE-2021-20180MEDIUMCVSS 5.5EG 5.52022-03-16
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_p…
- CVE-2022-27195MEDIUMCVSS 5.5EG 5.52022-03-15
Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are s…
- CVE-2022-22703MEDIUMCVSS 5.5EG 5.52022-01-17
In Stormshield SSO Agent 2.x before 2.1.1 and 3.x before 3.0.2, the cleartext user password and PSK are contained in the log file of the .exe installer.
- CVE-2021-44234MEDIUMCVSS 5.5EG 5.52022-01-14
SAP Business One - version 10.0, extended log stores information that can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
- CVE-2021-39032MEDIUMCVSS 5.5EG 5.52022-01-14
IBM Sterling Gentran:Server for Microsoft Windows 5.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 213962.
- CVE-2021-45449MEDIUMCVSS 5.5EG 5.52022-01-12
Docker Desktop version 4.3.0 and 4.3.1 has a bug that may log sensitive information (access token or password) on the user's machine during login. This only affects users if they are on Docker Desktop 4.3.0, 4.3.1 and the user has logged i…
- CVE-2021-0997MEDIUMCVSS 5.5EG 5.52021-12-15
In handleUpdateNetworkState of GnssNetworkConnectivityHandler.java , there is a possible APN disclosure due to log information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User…
- CVE-2021-37036MEDIUMCVSS 5.5EG 5.52021-11-23
There is an information leakage vulnerability in FusionCompute 6.5.1, eCNS280_TD V100R005C00 and V100R005C10. Due to the improperly storage of specific information in the log file, the attacker can obtain the information when a user logs i…
- CVE-2021-40364MEDIUMCVSS 5.5EG 5.52021-11-09
A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC04), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMATIC WinCC V15 and earlier (All versions < V15 SP1 Update 7), SIM…
- CVE-2020-10052MEDIUMCVSS 5.5EG 5.52021-11-09
A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as usernames and passwords in log files. A local attacker with access to the log files could …
- CVE-2021-32801MEDIUMCVSS 5.5EG 5.52021-09-07
Nextcloud server is an open source, self hosted personal cloud. In affected versions logging of exceptions may have resulted in logging potentially sensitive key material for the Nextcloud Encryption-at-Rest functionality. It is recommende…
- CVE-2021-34689MEDIUMCVSS 5.5EG 5.52021-07-15
iDrive RemotePC before 7.6.48 on Windows allows information disclosure. A locally authenticated attacker can read the system's Personal Key in world-readable %PROGRAMDATA% log files.
- CVE-2021-25423MEDIUMCVSS 5.5EG 5.52021-06-11
Improper log management vulnerability in Watch Active2 PlugIn prior to 2.2.08.21033151 version allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone via log.
- CVE-2021-25422MEDIUMCVSS 5.5EG 5.52021-06-11
Improper log management vulnerability in Watch Active PlugIn prior to version 2.2.07.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
- CVE-2021-25421MEDIUMCVSS 5.5EG 5.52021-06-11
Improper log management vulnerability in Galaxy Watch3 PlugIn prior to version 2.2.09.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
- CVE-2021-25420MEDIUMCVSS 5.5EG 5.52021-06-11
Improper log management vulnerability in Galaxy Watch PlugIn prior to version 2.2.05.21033151 allows attacker with log permissions to leak Wi-Fi password connected to the user smartphone within log.
- CVE-2021-20191MEDIUMCVSS 5.5EG 5.52021-05-26
A flaw was found in ansible. Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those creden…
- CVE-2021-20178MEDIUMCVSS 5.5EG 5.52021-05-26
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_p…
- CVE-2021-3447MEDIUMCVSS 5.5EG 5.52021-04-01
A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These p…
- CVE-2021-25688MEDIUMCVSS 5.5EG 5.52021-02-11
Under certain conditions, Teradici PCoIP Agents for Windows prior to version 20.10.0 and Teradici PCoIP Agents for Linux prior to version 21.01.0 may log parts of a user's password in the application logs.
- CVE-2020-4900MEDIUMCVSS 5.5EG 5.52020-11-30
IBM Business Automation Workflow 19.0.0.3 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 190991.
- CVE-2020-10763MEDIUMCVSS 5.5EG 5.52020-11-24
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwo…
- CVE-2020-10762MEDIUMCVSS 5.5EG 5.52020-11-24
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows …
- CVE-2020-14332MEDIUMCVSS 5.5EG 5.52020-09-11
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The hi…
- CVE-2020-25046MEDIUMCVSS 5.5EG 5.52020-08-31
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The USB driver leaks address information via kernel logging. The Samsung IDs are SVE-2020-17602, SVE-2020-17603, SVE-2020-17604 (August 2020).
- CVE-2020-3447MEDIUMCVSS 5.5EG 5.52020-08-17
A vulnerability in the CLI of Cisco AsyncOS for Cisco Email Security Appliance (ESA) and Cisco AsyncOS for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on a…
- CVE-2020-5908MEDIUMCVSS 5.5EG 5.52020-07-01
In versions bundled with BIG-IP APM 12.1.0-12.1.5 and 11.6.1-11.6.5.2, Edge Client for Linux exposes full session ID in the local log files.
- CVE-2020-1624MEDIUMCVSS 5.5EG 5.52020-04-08
A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via raw objmon configuration files. This issue affects all versions of Junos OS Evolved prior to 19.1R1.
- CVE-2020-1623MEDIUMCVSS 5.5EG 5.52020-04-08
A local, authenticated user with shell can view sensitive configuration information via the ev.ops configuration file. This issue affects all versions of Junos OS Evolved prior to 19.2R1.
- CVE-2020-1622MEDIUMCVSS 5.5EG 5.52020-04-08
A local, authenticated user with shell can obtain the hashed values of login passwords and shared secrets via the EvoSharedObjStore. This issue affects all versions of Junos OS Evolved prior to 19.1R1.
Map vulnerabilities like CWE-532 to your infrastructure
EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →