Weaknesses of type CWE-532

850 results

Exposição de Informações Sensíveis em Logs

Aplicações registram dados confidenciais (senhas, tokens, chaves de API, números de cartão) em arquivos de log que ficam acessíveis a usuários não autorizados ou são capturados em backups, análises e monitoramento. Esse registro desprotegido transforma logs em porta de entrada para comprometimento de credenciais e dados pessoais.

Example

Um sistema web que loga tentativas de autenticação incluindo username e senha em texto plano em /var/log/app.log, ou uma API que registra o token JWT completo em logs estruturados que acabam replicados em servidores de análise compartilhados com múltiplos times.

How to mitigate

Implemente um filtro de sanitização que mascara ou remove dados sensíveis antes de gravar em logs (senhas, tokens, PII). Restrinja acesso a arquivos de log apenas a usuários autorizados e implemente rotação de logs com criptografia de arquivos históricos. Revise periodicamente o que está sendo logado em produção.

CVE-2024-27156MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27157MEDIUMLeak of authentication sessions in secure logsEPSS 0.4%CVE-2024-27097MEDIUMPotential log injection in reset user endpoint in ckanEPSS 0.4%CVE-2026-32218MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2023-52146MEDIUMWordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data ExposureEPSS 0.4%CVE-2026-23493HIGHPimcore ENV Variables and Cookie Informations are exposed in http_error_logEPSS 0.4%CVE-2022-38133LOWIn JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some casesEPSS 0.4%CVE-2025-32054LOWIn JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log fileEPSS 0.4%CVE-2024-22440MEDIUMHPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive InformationEPSS 0.4%CVE-2026-22098CRITICALSensitive information is written to logsEPSS 0.4%CVE-2025-27391MEDIUMApache ActiveMQ Artemis: Passwords leaking from broker properties in the debug logEPSS 0.4%CVE-2020-10750HIGHSensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store EPSS 0.4%CVE-2018-20105MEDIUMyast2-rmt exposes CA private key passhrase in log-fileEPSS 0.4%CVE-2022-20651MEDIUMCisco Adaptive Security Device Manager Information Disclosure VulnerabilityEPSS 0.4%CVE-2019-14858HIGHA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramEPSS 0.4%CVE-2021-3791MEDIUMAn information disclosure vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an unauthenticated atEPSS 0.4%CVE-2026-32215MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2024-25095HIGHWordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerabilityEPSS 0.4%CVE-2026-32217MEDIUMWindows Kernel Information Disclosure VulnerabilityEPSS 0.4%CVE-2020-10763—An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with localEPSS 0.4%