CWE-532 Insertion of Sensitive Information into Log File
baseThe product writes sensitive information to a log file.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (1484)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24984US | —OT critical | KEV | ||
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. | ||||
| CVE-2023-21492US | medium4.4OT critical | KEV | ||
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. | ||||
| CVE-2023-43261US | high7.5 | Exploit | ||
An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. | ||||
| CVE-2022-47075US | high7.5 | Exploit | ||
An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to… | ||||
| CVE-2020-35234US | high7.5 | Exploit | ||
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/… | ||||
| CVE-2019-1622US | medium5.3 | Exploit | ||
A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information… | ||||
| CVE-1999-0045US | high7.5 | Exploit | ||
List of arbitrary files on Web host via nph-test-cgi script. | ||||
| CVE-2024-20440US | high7.5 | — | ||
A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.
This vulnerability is due to excessive verbosit… | ||||
| CVE-2023-40029US | critical9.6 | Exploit | ||
Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret bo… | ||||
| CVE-2018-12604US | high7.5 | Exploit | ||
GreenCMS 2.3.0603 allows remote attackers to obtain sensitive information via a direct request for Data/Log/year_month_day.log. | ||||
| CVE-2018-11716US | critical9.8 | — | ||
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critica… | ||||
| CVE-2018-11717US | critical9.8 | — | ||
An issue was discovered in Zoho ManageEngine Desktop Central before 100251. By leveraging access to a log file, a context-dependent attacker can obtain (depending on the modules co… | ||||
| CVE-2007-1647US | high7.8 | Exploit | ||
Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain… | ||||
| CVE-2006-6569US | high7.8 | Exploit | ||
form.php in GenesisTrader 1.0 allows remote attackers to read source code for arbitrary files and obtain sensitive information via the (1) do and (2) chem parameters with a "modfic… | ||||
| CVE-2001-1044US | high7.5 | Exploit | ||
Basilix Webmail 0.9.7beta, and possibly other versions, stores *.class and *.inc files under the document root and does not restrict access, which could allows remote attackers to… | ||||
| CVE-2024-9466US | medium6.5OT elevated | Exploit | ||
A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys g… | ||||
| CVE-2022-0725US | high7.5 | Exploit | ||
A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an… | ||||
| CVE-2013-1902US | high10.0OT elevated | — | ||
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames,… | ||||
| CVE-2007-0091US | high7.5 | Exploit | ||
newsCMSlite stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database containing passwords via a direct… | ||||
| CVE-2005-2229US | high7.5 | Exploit | ||
Blog Torrent 0.92 and earlier stores sensitive files under the web document root in the (1) data or (2) torrents directories with insufficient access control, which allows remote a… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan