CWE-534 DEPRECATED: Information Exposure Through Debug Log Files
variantThis entry has been deprecated because its abstraction was too low-level. See CWE-532.
01
vulnerabilities (19)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-11398US | high8.8 | Exploit | ||
A session hijacking via log disclosure vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an unauthenticated attacker to hijack ac… | ||||
| CVE-1999-0736US | medium5.0 | Exploit | ||
The showcode.asp sample file in IIS and Site Server allows remote attackers to read arbitrary files. | ||||
| CVE-2015-6941US | critical9.8 | — | ||
win_useradd, salt-cloud and the Linode driver in salt 2015.5.x before 2015.5.6, and 2015.8.x before 2015.8.1 leak password information in debug logs. | ||||
| CVE-2007-0156US | high7.5 | — | ||
M-Core stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to db/uyelik.mdb. | ||||
| CVE-2005-1427US | high7.5 | — | ||
Uapplication Uphotogallery stores the database under the web document root, which allows remote attackers to obtain sensitive information via a direct request to uphotogallery.mdb. | ||||
| CVE-2005-0853US | medium5.0 | Exploit | ||
betaparticle blog (bp blog) stores the database under the web root, which allows remote attackers to obtain sensitive information via a direct request to (1) dbBlogMX.mdb for versi… | ||||
| CVE-2022-49100US | medium5.5 | — | ||
In the Linux kernel, the following vulnerability has been resolved:
virtio_console: eliminate anonymous module_init & module_exit
Eliminate anonymous module_init() and module_exi… | ||||
| CVE-2020-2004US | medium5.5 | — | ||
Under certain circumstances a user's password may be logged in cleartext in the PanGPS.log diagnostic file when logs are collected for troubleshooting on GlobalProtect app (also kn… | ||||
| CVE-2006-0993US | medium5.0 | — | ||
The web management interface in 3Com TippingPoint SMS Server before 2.2.1.4478 does not restrict access to certain directories, which might allow remote attackers to obtain potenti… | ||||
| CVE-1999-1374US | medium5.0 | — | ||
perlshop.cgi shopping cart program stores sensitive customer information in directories and files that are under the web root, which allows remote attackers to obtain that informat… | ||||
| CVE-2004-2336US | medium5.0 | — | ||
Unknown vulnerability in Novell GroupWise and GroupWise WebAccess 6.0 through 6.5, when running with Apache Web Server 1.3 for NetWare where Apache is loaded using GWAPACHE.CONF, a… | ||||
| CVE-2002-0582US | medium5.0 | — | ||
WorkforceROI Xpede 4.1 stores temporary expense claim reports in a world-readable and indexable /reports/temp directory, which allows remote attackers to read the reports by access… | ||||
| CVE-2000-0682US | medium5.0 | — | ||
BEA WebLogic 5.1.x allows remote attackers to read source code for parsed pages by inserting /ConsoleHelp/ into the URL, which invokes the FileServlet. | ||||
| CVE-2005-2677US | medium5.0 | — | ||
ACNews stores the database in a file under the web document root with a db.inc extension and insufficient access control, which allows remote attackers to obtain sensitive informat… | ||||
| CVE-2000-1070US | medium5.0 | — | ||
pollit.cgi in Poll It 2.01 and earlier uses data files that are located under the web document root, which allows remote attackers to access sensitive or private information. | ||||
| CVE-2023-5028US | medium4.6 | — | ||
A vulnerability, which was classified as problematic, has been found in China Unicom TEWA-800G 4.16L.04_CT2015_Yueme. Affected by this issue is some unknown functionality. The mani… | ||||
| CVE-2007-0607US | medium4.3 | — | ||
W-Agora (Web-Agora) 4.2.1, when register_globals is enabled, stores globals.inc under the web document root with insufficient access control, which allows remote attackers to obtai… | ||||
| CVE-2021-3037US | low2.1 | — | ||
An information exposure through log file vulnerability exists in Palo Alto Networks PAN-OS software where the connection details for a scheduled configuration export are logged in… | ||||
| CVE-2025-8031US | —OT elevated | — | ||
The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox… | ||||
02
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan