CWE-532— Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.— MITRE CWE catalog

1,354 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-532page 26 of 28

CVE-2025-27496LOWCVSS 3.3EG 3.3
2025-03-13
Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG…
CVE-2024-45674LOWCVSS 3.3EG 3.3
2025-02-22
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores potentially sensitive information …
CVE-2025-24145LOWCVSS 3.3EG 3.3
2025-01-27
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.3 and iPadOS 18.3, macOS Sequoia 15.3. An app may be able to view a contact's phone number in system logs.
CVE-2024-27849LOWCVSS 3.3EG 3.3
2024-10-28
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive location information.
CVE-2024-40791LOWCVSS 3.3EG 3.3
2024-09-17
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An app may be able to acces…
CVE-2024-40096LOWCVSS 3.3EG 3.3
2024-08-05
The com.cascadialabs.who (aka Who - Caller ID, Spam Block) application 15.0 for Android places sensitive information in the system log.
CVE-2023-27502LOWCVSS 3.3EG 3.3
2024-03-14
Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2024-23242LOWCVSS 3.3EG 3.3
2024-03-08
A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 17.4 and iPadOS 17.4, macOS Sonoma 14.4. An app may be able to view Mail data.
CVE-2024-24939LOWCVSS 3.3EG 3.3
2024-02-06
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
CVE-2024-23210LOWCVSS 3.3EG 3.3
2024-01-23
This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. An app may be able to view a user's phone number in system logs.
CVE-2023-45585LOWCVSS 3.3EG 3.3
2023-11-14
An insertion of sensitive information into log file vulnerability [CWE-532] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6.6.3 and below, version 6.5.1 and below, version 6.4.2 and below, version 6.3.3 and below, version 6…
CVE-2023-42857LOWCVSS 3.3EG 3.3
2023-10-25
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data.
CVE-2023-40405LOWCVSS 3.3EG 3.3
2023-10-25
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensitive location information.
CVE-2023-40442LOWCVSS 3.3EG 3.3
2023-09-12
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Big Sur 11.7.9, iOS 15.7.8 and iPadOS 15.7.8, macOS Monterey 12.6.8. An app may be able to read sensitive location information.
CVE-2023-40392LOWCVSS 3.3EG 3.3
2023-09-06
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.5. An app may be able to read sensitive location information.
CVE-2023-26207LOWCVSS 3.3EG 3.3
2023-06-13
An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProxy 7.0.0 through 7.0.10. 7.2.0 through 7.2.1 allows an attacker to read certain passwords in plain text.
CVE-2023-28351LOWCVSS 3.3EG 3.3
2023-05-31
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these …
CVE-2023-31413LOWCVSS 3.3EG 3.3
2023-05-04
Filebeat versions through 7.17.9 and 8.6.2 have a flaw in httpjson input that allows the http request Authorization or Proxy-Authorization header contents to be leaked in the logs when debug logging is enabled.
CVE-2022-48435LOWCVSS 3.3EG 3.3
2023-04-04
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
CVE-2023-23505LOWCVSS 3.3EG 3.3
2023-02-27
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur 11.7.3, iOS 15.7.3 and iPadOS 15.7.3, iOS 16.3 and iPadOS 16.3…
CVE-2022-39893LOWCVSS 3.3EG 3.3
2022-11-09
Sensitive information exposure vulnerability in FmmBaseModel in Galaxy Buds Pro Manage prior to version 4.1.22092751 allows local attackers with log access permission to get device identifier data through device log.
CVE-2022-31186LOWCVSS 3.3EG 3.3
2022-08-01
NextAuth.js is a complete open source authentication solution for Next.js applications. An information disclosure vulnerability in `next-auth` before `v4.10.2` and `v3.29.9` allows an attacker with log access privilege to obtain excessive …
CVE-2022-33697LOWCVSS 3.3EG 3.3
2022-07-12
Sensitive information exposure vulnerability in ImsServiceSwitchBase in ImsCore prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
CVE-2022-33688LOWCVSS 3.3EG 3.3
2022-07-12
Sensitive information exposure vulnerability in EventType in SecTelephonyProvider prior to SMR Jul-2022 Release 1 allows local attackers with log access permission to get IMSI through device log.
CVE-2022-33687LOWCVSS 3.3EG 3.3
2022-07-12
Exposure of Sensitive Information in telephony-common.jar prior to SMR Jul-2022 Release 1 allows local attackers to access IMSI via log.
CVE-2022-30742LOWCVSS 3.3EG 3.3
2022-06-07
Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sim card information through device log.
CVE-2022-30741LOWCVSS 3.3EG 3.3
2022-06-07
Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to get sim card information through device log.
CVE-2021-39739LOWCVSS 3.3EG 3.3
2022-03-30
In ArrayMap, there is a possible leak of the content of SMS messages due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…
CVE-2022-0021LOWCVSS 3.3EG 3.3
2022-02-10
An information exposure through log file vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that logs the cleartext credentials of the connecting GlobalProtect user when authenticating using Connect Before Logon fe…
CVE-2021-26908LOWCVSS 3.3EG 3.3
2021-04-23
Automox Agent prior to version 31 logs potentially sensitive information in local log files, which could be used by a locally-authenticated attacker to subvert an organization's security program. The issue has since been fixed in version 3…
CVE-2020-2048LOWCVSS 3.3EG 3.3
2020-11-12
An information exposure through log file vulnerability exists where the password for the configured system proxy server for a PAN-OS appliance may be displayed in cleartext when using the CLI in Palo Alto Networks PAN-OS software. This iss…
CVE-2020-2044LOWCVSS 3.3EG 3.3
2020-09-09
An information exposure through log file vulnerability where an administrator's password or other sensitive information may be logged in cleartext while using the CLI in Palo Alto Networks PAN-OS software. The opcmdhistory.log file was int…
CVE-2020-2043LOWCVSS 3.3EG 3.3
2020-09-09
An information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Palo Alto Networks PAN-OS software when the after-change-detail custom syslog field is enabled for confi…
CVE-2019-20625LOWCVSS 3.3EG 3.3
2020-03-24
An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) (Exynos chipsets) software. The ion debugfs driver allows information disclosure. The Samsung ID is SVE-2018-13427 (February 2019).
CVE-2019-9277LOWCVSS 3.3EG 3.3
2019-09-27
In the proc filesystem, there is a possible information disclosure due to log information disclosure. This could lead to local disclosure of app and browser activity with User execution privileges needed. User interaction is not needed for…
CVE-2017-18423LOWCVSS 3.3EG 3.3
2019-08-02
In cPanel before 66.0.2, domain log files become readable after log processing (SEC-273).
CVE-2019-4296LOWCVSS 3.3EG 3.3
2019-07-01
IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.
CVE-2017-9271LOWCVSS 3.3EG 3.3
2018-03-01
The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.
CVE-2018-5693LOWCVSS 3.3EG 3.3
2018-01-14
The LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover mailbox names by reading /var/log/magicspam/mslog.
CVE-2016-0296LOWCVSS 3.3EG 3.3
2017-02-01
IBM Tivoli Endpoint Manager - Mobile Device Management (MDM) stores potentially sensitive information in log files that could be available to a local user.
CVE-2016-5432LOWCVSS 3.3EG 3.3
2016-10-03
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
CVE-2022-36877LOWCVSS 2.8EG 3.3
2022-09-09
Exposure of Sensitive Information in FaqSymptomCardViewModel in Samsung Members prior to versions 4.3.00.11 in Global and 14.0.02.4 in China allows local attackers to access device identification via log.
CVE-2022-25830LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Galaxy Watch3 Plugin prior to version 2.2.09.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25829LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Watch Active2 Plugin prior to version 2.2.08.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25828LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25827LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25826LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Galaxy S3 Plugin prior to version 2.2.03.22012751 allows attacker to access password information of connected WiFiAp in the log
CVE-2022-25823LOWCVSS 1.9EG 3.3
2022-03-10
Information Exposure vulnerability in Galaxy Watch Plugin prior to version 2.2.05.220126741 allows attackers to access user information in log.
CVE-2026-25211LOWCVSS 3.2EG 3.2
2026-01-30
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
CVE-2025-24034LOWCVSS 3.2EG 3.2
2025-01-23
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and 0.8.3, Himmelblau is vulnerable to leaking credentials in debug logs. When debug logging is enabled…

Map vulnerabilities like CWE-532 to your infrastructure

EchelonGraph correlates every CVE — across CWE-532 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →