CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
A kind of CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory.
From the CWE List. © The MITRE Corporation.
Newest
- vmware horizon view agent, horizon view agents +1 moreVMware Horizon View Agents (7.x.x before 7.5.1) contain a local information disclosure...7.8 High
- zohocorp manageengine desktop centralAn issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access...9.8 Critical
- zohocorp manageengine desktop centralAn issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is...9.8 Critical
- juniper contrail service orchestrationJuniper Networks CSO versions prior to 4.0.0 may log passwords in log files leading to an...9.8 Critical
- sap dynamic authorization management, dynamic authorization management (dam) by nextlabs (java policy controller versions) +1 moreUnder certain circumstances SAP Dynamic Authorization Management (DAM) by NextLabs (Java Policy...4.4 Medium
- [unknown] moodleMoodle sensitive information disclosure4.3 Medium
- ibm websphere mq, websphere mq managed file transfer +1 moreIBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly...4.4 Medium
- [unknown] ansible, canonical ubuntu linux, debian linux +4 more +6 moreAnsible exposes sensitive data in log files and on the terminal5.9 Medium
- ovirt, [unknown] ovirt-engine-setup, redhat enterprise virtualization manager +2 moreovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log...5.0 Medium
- microfocus solutions business manager, micro focus solutions business manager 11.4 +1 moreMicro Focus Solutions Business Manager versions prior to 11.4 allows a user to invoke SBM RESTful...6.5 Medium
- microfocus solutions business manager, micro focus solutions business manager 11.4 +1 moreMicro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive...7.5 High
- njtech greencmsGreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request...7.5 High
- [unknown] ovirt-ansible-roles, redhat enterprise virtualization +1 moreovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive,...5.0 Medium
- [unknown] ovirt-engine, ovirt +1 moreovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db...5.0 Medium
- cisco prime collaborationA vulnerability in the web portal authentication process of Cisco Prime Collaboration...7.8 High
- ibm security access manager, security access manager for mobile, security access manager for web +2 moreIBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores...4.3 Medium
- grunt-gh-pages project grunt-gh-pages, hackerone grunt-gh-pages node module +1 moregrunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file8.6 High
- dell emc recoverpoint, recoverpoint virtual machine (vm), emc recoverpoint for virtual machines +2 moreDell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3,...8.8 High
- octopus serverIn Octopus Deploy 2018.4.4 through 2018.5.1, Octopus variables that are sourced from the target...9.8 Critical
- wpsecurityauditlog wp security audit logAn issue was discovered in the WP Security Audit Log plugin 3.1.1 for WordPress. Access to wp...5.3 Medium
- ibm qradar security information and event manager, security qradar siem +1 moreIBM QRadar 7.3 stores potentially sensitive information in log files that could be read by a...4.0 Medium
- elastic logstashWhen logging warnings regarding deprecated settings, Logstash before 5.6.6 and 6.x before 6.1.2...6.5 Medium
- vmware pivotal software mysqlMySQL for PCF tiles 1.7.x before 1.7.10 were discovered to log the AWS access key in plaintext....10.0 Critical
- netiq identity managerNetIQ Identity Manager Driver Component Information Leakage2.3 Low
- netiq identity managerNetIQ Identity Manager Driver Component Log File Information Leakage2.3 Low
- ionicframework ios keychainIonic Team Cordova plugin iOS Keychain version before commit...9.8 Critical
- django-anymail project django-anymaildjango-anymail Includes Sensitive Information in Log Files7.4 High
- giribaz file managerinc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity...7.5 High
- ithemes securityThe iThemes Security plugin before 6.9.1 for WordPress does not properly perform data escaping...7.5 High
- netiq identity manager oracle ebs driver, identity manager +1 moreAvoid password disclosure via EBS event logging in the iManager Oracle driver3.3 Low
- netiq identity managerNetIQ Identity Manager JDBC driver could leak passwords in exception traces3.3 Low
- opensuse zypper, fedoraproject fedora +1 moreproxy credentials written to log files by zypper4.0 Medium
- trend micro interscan messaging security virtual applianceA vulnerability in the Trend Micro InterScan Messaging Security Virtual Appliance 9.0 and 9.1...8.1 High
- sap hana extended application servicesA plain keystore password is written to a system log file in SAP HANA Extended Application...6.5 Medium
- sensu coreLow severity vulnerability that affects sensu9.8 Critical
- ovirt ovirt-hosted-engine-setupAn information disclosure in ovirt-hosted-engine-setup prior to 2.2.7 reveals the root user's...7.8 High
- linuxmagic magicspamThe LinuxMagic MagicSpam extension before 2.0.14-1 for Plesk allows local users to discover...3.3 Low
- ibm security key lifecycle managerIBM Tivoli Key Lifecycle Manager 2.5, 2.6, and 2.7 discloses sensitive information in error...4.3 Medium
- f5 big-ip apm, big-ip access policy manager +1 moreIn F5 BIG-IP APM software version 13.0.0 and 12.1.2, under rare conditions, the BIG-IP APM system...5.9 Medium
- dell emc scaleioAn issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support...8.4 High
- misp-project mispThe admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the...4.9 Medium
- mahara mobileMahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in...9.8 Critical
- red hat ansible, redhat enterprise linux server +1 moreAnsible Insertion of Sensitive Information into Log File vulnerability9.8 Critical
- ndocsoftware ndocBefore Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache)...9.8 Critical
- f5 big-ip access policy manager, big-ip advanced firewall manager, big-ip analytics +9 more +11 moreIn F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM, and WebSafe 11.5...9.8 Critical
- redmine, debian linux +1 moreIn Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain sensitive information...7.5 High
- torproject torThe rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x...5.9 Medium
- stashcat heinekingmediaAn issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login...6.5 Medium
- rsyslogrsyslog uses weak permissions for generating log files, which allows local users to obtain...5.5 Medium
- cisco ultra services frameworkA vulnerability in the AutoVNF tool for the Cisco Ultra Services Framework could allow an...9.8 Critical
- Show moreLoading…