CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
A kind of CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory.
From the CWE List. © The MITRE Corporation.
Newest
- ivanti xtractionAn Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before...5.5 Medium
- gitlabInsertion of Sensitive Information into Log File in GitLab6.2 Medium
- elated-themes frappeFrappe 14.x before 14.45.0 Information Disclosure via Error Log Tracebacks6.9 Medium
- progress software corporation marklogic serverSensitive information exposure in Progress MarkLogic Server Azure deployments7.5 High
- progress software corporation marklogic serverSensitive information exposure in Progress MarkLogic Server trace logs8.1 High
- predibase loraxPredibase LoRAX through 0.12.1 API Token Exposure via Router Logs6.8 Medium
- hugging face text embeddings inferenceHugging Face Text Embeddings Inference through 1.9.4 Cleartext API Key Logging4.8 Medium
- tbphp gpt-loadGPT-Load through 1.4.11 Cleartext Proxy Key Logging via Access Logger4.8 Medium
- aws aws-tools-for-powershellInsertion of sensitive information into log file in AWS Tools for PowerShell6.7 Medium
- ibm guardium data protectionSecurity vulnerability affects the UNIX S-TAP component as part of IBM Guardium Data Protection3.1 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted when `include_content=False`2.3 Low
- pydantic ai, pydantic-ai, pydantic-ai-slim +2 morePydantic AI OpenTelemetry instrumentation: exception events on tool and agent run spans include content when `include_content=False`2.3 Low
- brocade fabric os, broadcom fabric operating system +1 moreAn information disclosure vulnerability exists in the SupportLink diagnostic collection utilities...6.8 Medium
- apache software foundation geodeApache Geode: Management REST API: Insertion of Sensitive Information into Log File7.5 High
- asus routerInsertion of Sensitive Information into Log File in certain ASUS router models allows a remote...8.4 High
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information exposure in scaffolder task logs6.5 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Sensitive information may be exposed in Scaffolder task failure events5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Secret-derived values may be exposed in scaffolder task logs4.9 Medium
- dell container storage modulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive...6.5 Medium
- dell container storage modulesDell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive...7.7 High
quartPyPIQuart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__7.5 High- triggerdotdev trigger.devTrigger.dev CLI before 4.5.9 Secret Exposure via Debug Deployment Logs6.8 Medium
- armatura llc one, one (usa) +1 moreArmatura LLC Armatura One Insertion of Sensitive Information into Log File8.5 High
- armatura llc one, one (usa) +1 moreArmatura LLC Armatura One Insertion of Sensitive Information into Log File5.1 Medium
- canonical postgresql-operatorMonitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm5.3 Medium
- @opentelemetry instrumentation-cassandra-driver, instrumentation-knex, instrumentation-mongoose +6 more +8 moreMultiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute5.8 Medium
- apache software foundation apisixApache APISIX: data-mask may fail to redact request headers in logger output5.7 Medium
- pgpool global development group pgpool-iiPgpool-II inserts sensitive information into log file, which may allow an authenticated attacker...5.3 Medium
- apache apache-airflow-providers-teradata, apache software foundation airflow teradata provider +1 moreApache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs6.5 Medium
- grafana enterprise, oss +1 moreOAuth and OIDC tokens written unredacted to server logs by the Generic OAuth, Google and GitLab connectors6.0 Medium
- zammadZammad: Microsoft Graph error logs expose partially masked OAuth access tokens5.1 Medium
- brocade sannavIncomplete property masking in the SANnav logging subsystem6.4 Medium
- brocade sannavInformation exposure vulnerability in the job scheduling component of SANnav before 3.0.1a6.9 Medium
- brocade sannavIncomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a8.4 High
- botslab g980hBotslab G980H Dashcams Insertion of Sensitive Information into Log File5.1 Medium
- brocade sannavImproper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav before 3.0.1.a8.5 High
- brocade sannavPlaintext exposure of sensitive authentication data in SANnav discovery service log files8.5 High
- openbaoOpenBao Agent Writes Secrets to Stdout2.4 Low
- openclaw iosOpenClaw iOS before 2026.8.11 Credential Exposure via Deep-Link URL Logging7.2 High
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs5.6 Medium
- dell command powershell provider (dcpp)Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of...7.8 High
- openpanel-dev openpanelOpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext4.8 Medium
- jupyter-server jupyter serverJupyter Server: 5xx request logging leaks token-bearing Referer header values7.1 High
- mongodb entity framework core providerLogs may collect sensitive information5.7 Medium
- team-alembic ash authenticationActor record with password digest stored in AshAuthentication audit log entries1.8 Low
- cjbi admin3admin3 through 3.0.0 Session Token Disclosure via Audit Log8.7 High
- open-telemetry opentelemetry-goOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs2.0 Low
- arista networks eosUnder certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.6.0 Medium
- arista networks eosOn affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privil…2.1 Low
- devolutions powershell universalInsertion of sensitive information into log file in the slow query logging feature in Devolutions...6.5 Medium
- Show moreLoading…