CWE-532 Insertion of Sensitive Information into Log File
baseThe product writes sensitive information to a log file.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (1484)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24984US | —OT kritisch | KEV | ||
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. | ||||
| CVE-2023-21492US | medium4.4OT kritisch | KEV | ||
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. | ||||
| CVE-2023-43261US | high7.5 | Exploit | ||
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. | ||||
| CVE-2022-47075US | high7.5 | Exploit | ||
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to… | ||||
| CVE-2020-35234US | high7.5 | Exploit | ||
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/… | ||||
| CVE-2019-1622US | medium5.3 | Exploit | ||
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information… | ||||
| CVE-1999-0045US | high7.5 | Exploit | ||
List of arbitrary files on Web host via nph-test-cgi script. | ||||
| CVE-2024-20440US | high7.5 | — | ||
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.
This vulnerability is due to excessive verbosit… | ||||
| CVE-2023-40029US | critical9.6 | Exploit | ||
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret bo… | ||||
| CVE-2018-12604US | high7.5 | Exploit | ||
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. | ||||
| CVE-2018-11716US | critical9.8 | — | ||
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critica… | ||||
| CVE-2018-11717US | critical9.8 | — | ||
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules co… | ||||
| CVE-2007-1647US | high7.8 | Exploit | ||
Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain… | ||||
| CVE-2006-6569US | high7.8 | Exploit | ||
form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfic… | ||||
| CVE-2001-1044US | high7.5 | Exploit | ||
Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to… | ||||
| CVE-2024-9466US | medium6.5OT erhöht | Exploit | ||
A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys g… | ||||
| CVE-2022-0725US | high7.5 | Exploit | ||
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an… | ||||
| CVE-2013-1902US | high10.0OT erhöht | — | ||
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames,… | ||||
| CVE-2007-0091US | high7.5 | Exploit | ||
newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct… | ||||
| CVE-2005-2229US | high7.5 | Exploit | ||
Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the (1) data or (2) torrents directories with insufficient access control, which allows remote a… | ||||
03
Angriffsmuster (1)
CAPEC-Angriffsmuster, die dies ausnutzen.
04
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan